terruvim-core-test 0.0.1

package/dist/src/factories/ecsCodePipelineFactory.js

@@ -0,0 +1,308 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ECSCodePipelineFactory = void 0;
+const aws = __importStar(require("@pulumi/aws"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const resourceFactory_1 = require("./resourceFactory");
+class ECSCodePipelineFactory extends resourceFactory_1.ResourceFactory {
+    createPipelinePolicyDoc(config) {
+        return JSON.stringify({
+            Version: "2012-10-17",
+            Statement: [
+                {
+                    Effect: "Allow",
+                    Action: [
+                        "ec2:*",
+                        "elasticloadbalancing:*",
+                        "autoscaling:*",
+                        "cloudwatch:*",
+                        "s3:*",
+                        "sns:*",
+                        "cloudformation:*",
+                        "rds:*",
+                        "sqs:*",
+                        "ecs:*",
+                        "iam:PassRole",
+                        "codebuild:*",
+                        "codestar-connections:UseConnection"
+                    ],
+                    Resource: "*"
+                }
+            ]
+        });
+    }
+    async createResource(config, provider) {
+        const { configuration } = config;
+        const environment = config.meta?.environment || 'dev';
+        const resourceId = config.id || 'pipeline';
+        const codebuildRole = new aws.iam.Role(`${environment}-${resourceId}-codebuild-role`, {
+            assumeRolePolicy: JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Principal: { Service: "codebuild.amazonaws.com" },
+                        Action: "sts:AssumeRole"
+                    }
+                ]
+            }),
+            tags: configuration.tags,
+        }, provider ? { provider } : undefined);
+        const codebuildPolicy = new aws.iam.Policy(`${environment}-${resourceId}-codebuild-policy`, {
+            description: "Minimal policy for CodeBuild project",
+            policy: JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Action: [
+                            "logs:*",
+                            "s3:*",
+                            "codebuild:*",
+                            "ecr:*",
+                            "ecs:*",
+                            "iam:PassRole",
+                            "ec2:DescribeSecurityGroups",
+                            "ec2:DescribeSubnets",
+                            "ec2:DescribeVpcs",
+                            "ec2:DescribeNetworkInterfaces",
+                            "ec2:CreateNetworkInterface",
+                            "ec2:DeleteNetworkInterface",
+                            "ec2:DescribeDhcpOptions",
+                            "ec2:*",
+                            "*"
+                        ],
+                        Resource: "*"
+                    }
+                ]
+            })
+        }, provider ? { provider } : undefined);
+        new aws.iam.RolePolicyAttachment(`${environment}-${resourceId}-codebuild-policy-attach`, {
+            role: codebuildRole.name,
+            policyArn: codebuildPolicy.arn
+        }, provider ? { provider } : undefined);
+        const pipelineRole = new aws.iam.Role(`${environment}-${resourceId}-pipeline-role`, {
+            assumeRolePolicy: JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Principal: { Service: "codepipeline.amazonaws.com" },
+                        Action: "sts:AssumeRole"
+                    }
+                ]
+            }),
+            tags: configuration.tags,
+        }, provider ? { provider } : undefined);
+        const pipelinePolicy = new aws.iam.Policy(`${environment}-${resourceId}-pipeline-policy`, {
+            description: "Minimal policy for CodePipeline",
+            policy: this.createPipelinePolicyDoc(config)
+        }, provider ? { provider } : undefined);
+        new aws.iam.RolePolicyAttachment(`${environment}-${resourceId}-pipeline-policy-attach`, {
+            role: pipelineRole.name,
+            policyArn: pipelinePolicy.arn
+        }, provider ? { provider } : undefined);
+        const artifactBucket = new aws.s3.Bucket(`${environment}-${resourceId}-artifacts`, {
+            forceDestroy: configuration.s3BucketForceDestroy ?? true,
+            tags: configuration.tags,
+        }, provider ? { provider } : undefined);
+        let buildspec = undefined;
+        if (configuration.buildspecPath) {
+            const buildspecPath = configuration.buildspecPath;
+            const isExternal = path.isAbsolute(buildspecPath) || buildspecPath.startsWith("../") || buildspecPath.includes("/assets/cicd/buildspecs/");
+            if (isExternal) {
+                try {
+                    buildspec = fs.readFileSync(buildspecPath, "utf8");
+                }
+                catch (e) {
+                    throw new Error(`Failed to read external buildspec at ${buildspecPath}: ${e}`);
+                }
+            }
+            else {
+                buildspec = buildspecPath;
+            }
+        }
+        else {
+            buildspec = "buildspec.yml";
+        }
+        let vpcConfig = undefined;
+        if (configuration.deployCodePipelineInVpc && config.inputs?.vpcId) {
+            vpcConfig = {
+                vpcId: config.inputs.vpcId,
+                subnets: config.inputs.subnetIds,
+                securityGroupIds: config.inputs.securityGroupIds,
+            };
+        }
+        const codebuildProject = new aws.codebuild.Project(`${environment}-${resourceId}-build`, {
+            source: {
+                type: "CODEPIPELINE",
+                buildspec,
+            },
+            artifacts: {
+                type: "CODEPIPELINE",
+            },
+            environment: {
+                computeType: configuration.computeType || "BUILD_GENERAL1_LARGE",
+                image: configuration.buildImage || "aws/codebuild/amazonlinux2-x86_64-standard:4.0",
+                type: configuration.environmentType || "LINUX_CONTAINER",
+                privilegedMode: configuration.privilegedMode || false,
+                environmentVariables: configuration.buildEnvironmentVariables,
+            },
+            serviceRole: codebuildRole.arn,
+            tags: configuration.tags,
+            vpcConfig,
+        }, provider ? { provider } : undefined);
+        const sourceAction = {
+            name: "Source",
+            category: "Source",
+            owner: "AWS",
+            provider: "CodeStarSourceConnection",
+            version: "1",
+            outputArtifacts: ["source_output"],
+            configuration: {
+                ConnectionArn: configuration.codestarConnectionArn,
+                FullRepositoryId: `${configuration.repoOwner}/${configuration.repoName}`,
+                BranchName: configuration.branch,
+                DetectChanges: configuration.pollSourceChanges ? "true" : "false",
+                OutputArtifactFormat: configuration.outputArtifactFormat ?? "CODEBUILD_CLONE_REF",
+            },
+        };
+        const checkoutStage = {
+            name: "Checkout",
+            actions: [sourceAction],
+        };
+        const buildAction = {
+            name: "Build",
+            category: "Build",
+            owner: "AWS",
+            provider: "CodeBuild",
+            inputArtifacts: ["source_output"],
+            outputArtifacts: ["build_output"],
+            version: "1",
+            configuration: {
+                ProjectName: codebuildProject.name,
+            },
+        };
+        const buildStage = {
+            name: "Build",
+            actions: [buildAction],
+        };
+        let deployAction;
+        if (configuration.ecsClusterName && configuration.ecsServiceName) {
+            deployAction = {
+                name: "Deploy",
+                category: "Deploy",
+                owner: "AWS",
+                provider: "ECS",
+                inputArtifacts: ["build_output"],
+                version: "1",
+                configuration: {
+                    ClusterName: configuration.ecsClusterName,
+                    ServiceName: configuration.ecsServiceName,
+                },
+                runOrder: 1,
+            };
+        }
+        else {
+            deployAction = {
+                name: "Deploy",
+                category: "Deploy",
+                owner: "AWS",
+                provider: "CloudFormation",
+                inputArtifacts: ["build_output"],
+                version: "1",
+                configuration: {
+                    ActionMode: "CHANGE_SET_REPLACE",
+                    StackName: `${environment}-${resourceId}-stack`,
+                    Capabilities: "CAPABILITY_NAMED_IAM",
+                    TemplatePath: "build_output::template.yaml",
+                },
+                runOrder: 1,
+            };
+        }
+        const deployStage = {
+            name: "Deploy",
+            actions: [deployAction],
+        };
+        const stages = configuration.stages && configuration.stages.length > 0
+            ? configuration.stages
+            : [checkoutStage, buildStage, deployStage];
+        const pipeline = new aws.codepipeline.Pipeline(`${environment}-${resourceId}-pipeline`, {
+            roleArn: pipelineRole.arn,
+            artifactStores: [{
+                    location: artifactBucket.bucket,
+                    type: "S3"
+                }],
+            stages,
+            tags: configuration.tags,
+            name: `${environment}-${resourceId}`,
+        }, provider ? { provider } : undefined);
+        let webhook;
+        if (configuration.webhookEnabled) {
+            const webhookConfig = configuration.webhookConfig || {};
+            webhook = new aws.codepipeline.Webhook(`${environment}-${resourceId}-webhook`, {
+                authentication: webhookConfig.authentication || "GITHUB_HMAC",
+                targetAction: webhookConfig.targetAction || "Source",
+                targetPipeline: `${environment}-${resourceId}-pipeline`,
+                authenticationConfiguration: webhookConfig.secretToken ? {
+                    secretToken: webhookConfig.secretToken,
+                } : undefined,
+                filters: [
+                    {
+                        jsonPath: webhookConfig.filterJsonPath || "$.ref",
+                        matchEquals: webhookConfig.filterMatchEquals || `refs/heads/${configuration.branch}`,
+                    },
+                ],
+            }, provider ? { provider } : undefined);
+        }
+        return pipeline;
+    }
+    getOutputs(resource) {
+        const region = resource.region || resource.location || "us-east-1";
+        return {
+            arn: resource.arn,
+            name: resource.name,
+            url: `https://${region}.console.aws.amazon.com/codesuite/codepipeline/pipelines/${resource.name}/view?region=${region}`,
+        };
+    }
+    validateConfig(config) {
+        if (!config.configuration || !config.configuration.repoOwner || !config.configuration.repoName || !config.configuration.branch || !config.configuration.codestarConnectionArn) {
+            throw new Error("CodePipeline config must include repoOwner, repoName, branch, codestarConnectionArn");
+        }
+    }
+}
+exports.ECSCodePipelineFactory = ECSCodePipelineFactory;

package/dist/src/factories/ecsServiceFactory.js

@@ -0,0 +1,350 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceFactory = void 0;
+const aws = __importStar(require("@pulumi/aws"));
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const resourceFactory_1 = require("./resourceFactory");
+const getDeterministicPriority_1 = require("./getDeterministicPriority");
+const buildForceRedeployEnv_1 = require("./buildForceRedeployEnv");
+const collectSecretKeys_1 = require("./collectSecretKeys");
+const fetchAllSecrets_1 = require("./fetchAllSecrets");
+const resolveEnvSecrets_1 = require("./resolveEnvSecrets");
+const createEnvSecret_1 = require("./createEnvSecret");
+const buildEcsSecrets_1 = require("./buildEcsSecrets");
+const createEcsRolesAndPolicies_1 = require("./createEcsRolesAndPolicies");
+const createTaskDefinition_1 = require("./createTaskDefinition");
+const createEcsService_1 = require("./createEcsService");
+const buildAndPushDockerImage_1 = require("./buildAndPushDockerImage");
+const attachSecretAccessPolicy_1 = require("./attachSecretAccessPolicy");
+const createLogGroup_1 = require("./createLogGroup");
+const createEcrRepo_1 = require("./createEcrRepo");
+const createTargetGroup_1 = require("./createTargetGroup");
+const createListenerRule_1 = require("./createListenerRule");
+const dataProtectionPolicyBuilder_1 = require("./dataProtectionPolicyBuilder");
+function createAutoScaling(service, clusterName, autoScalingConfig, resourceNamePrefix, provider) {
+    const resourceId = pulumi.interpolate `service/${clusterName}/${service.name}`;
+    const targetResourceName = `${resourceNamePrefix}-autoscaling-target`;
+    const scalingTarget = new aws.appautoscaling.Target(targetResourceName, {
+        maxCapacity: autoScalingConfig.maxCapacity || 10,
+        minCapacity: autoScalingConfig.minCapacity || 1,
+        resourceId: resourceId,
+        scalableDimension: "ecs:service:DesiredCount",
+        serviceNamespace: "ecs",
+    }, { provider, dependsOn: [service] });
+    const policies = [];
+    if (autoScalingConfig.targetCPUUtilization) {
+        const cpuPolicyResourceName = `${resourceNamePrefix}-cpu-scaling-policy`;
+        const cpuPolicy = new aws.appautoscaling.Policy(cpuPolicyResourceName, {
+            name: `${resourceNamePrefix}-cpu-scaling`,
+            policyType: "TargetTrackingScaling",
+            resourceId: resourceId,
+            scalableDimension: "ecs:service:DesiredCount",
+            serviceNamespace: "ecs",
+            targetTrackingScalingPolicyConfiguration: {
+                targetValue: autoScalingConfig.targetCPUUtilization,
+                predefinedMetricSpecification: {
+                    predefinedMetricType: "ECSServiceAverageCPUUtilization",
+                },
+                scaleInCooldown: autoScalingConfig.scaleInCooldown || 300,
+                scaleOutCooldown: autoScalingConfig.scaleOutCooldown || 300,
+            },
+        }, {
+            provider,
+            dependsOn: [scalingTarget]
+        });
+        policies.push(cpuPolicy);
+    }
+    if (autoScalingConfig.targetMemoryUtilization) {
+        const memoryPolicyResourceName = `${resourceNamePrefix}-memory-scaling-policy`;
+        const memoryPolicy = new aws.appautoscaling.Policy(memoryPolicyResourceName, {
+            name: `${resourceNamePrefix}-memory-scaling`,
+            policyType: "TargetTrackingScaling",
+            resourceId: resourceId,
+            scalableDimension: "ecs:service:DesiredCount",
+            serviceNamespace: "ecs",
+            targetTrackingScalingPolicyConfiguration: {
+                targetValue: autoScalingConfig.targetMemoryUtilization,
+                predefinedMetricSpecification: {
+                    predefinedMetricType: "ECSServiceAverageMemoryUtilization",
+                },
+                scaleInCooldown: autoScalingConfig.scaleInCooldown || 300,
+                scaleOutCooldown: autoScalingConfig.scaleOutCooldown || 300,
+            },
+        }, {
+            provider,
+            dependsOn: [scalingTarget]
+        });
+        policies.push(memoryPolicy);
+    }
+    return {
+        scalingTarget,
+        policies
+    };
+}
+class ServiceFactory extends resourceFactory_1.ResourceFactory {
+    async createResource(config, provider) {
+        const { configuration, inputs, meta } = config;
+        const { taskRolePolicyStatements, executionRolePolicyStatements } = configuration;
+        if (!configuration.name) {
+            throw new Error("Invalid service configuration: Missing 'name' property.");
+        }
+        if (!inputs.albListenerArn || !inputs.albSgId || !inputs.subnets || !inputs.clusterArn) {
+            throw new Error("Missing required inputs for service deployment (albListenerArn, albSgId, subnets, clusterArn)");
+        }
+        const enableTargetGroup = configuration.enableTargetGroup !== false;
+        const enableAlbListenerRules = configuration.enableAlbListenerRules !== false;
+        let tg = undefined;
+        if (enableTargetGroup) {
+            tg = (0, createTargetGroup_1.createTargetGroup)({
+                name: configuration.name,
+                environment: meta.environment,
+                port: configuration.port,
+                vpcId: inputs.vpcId,
+                healthCheckPath: configuration.healthCheckPath,
+                protocol: configuration.protocol
+            }, provider);
+        }
+        let listenerRules = [];
+        if (enableTargetGroup && enableAlbListenerRules && tg) {
+            const listenerRulePriority = (0, getDeterministicPriority_1.getDeterministicPriority)(config.id, configuration.priority);
+            if (Array.isArray(configuration.albListenerRules) && configuration.albListenerRules.length > 0) {
+                listenerRules = configuration.albListenerRules.map((rule, idx) => tg ? (0, createListenerRule_1.createListenerRule)({
+                    name: configuration.name,
+                    environment: meta.environment,
+                    listenerArn: inputs.albListenerArn,
+                    priority: rule.priority || (0, getDeterministicPriority_1.getDeterministicPriority)(`${config.id}-${idx}`),
+                    targetGroupArn: tg.arn,
+                    conditions: rule.conditions
+                }, provider) : undefined).filter(Boolean);
+            }
+            else {
+                if (tg) {
+                    listenerRules = [(0, createListenerRule_1.createListenerRule)({
+                            name: configuration.name,
+                            environment: meta.environment,
+                            listenerArn: inputs.albListenerArn,
+                            priority: listenerRulePriority,
+                            targetGroupArn: tg.arn,
+                            path: configuration.path
+                        }, provider)];
+                }
+                else {
+                    listenerRules = [];
+                }
+            }
+        }
+        const { taskRole, executionRole } = (0, createEcsRolesAndPolicies_1.createEcsRolesAndPolicies)({
+            name: configuration.name,
+            environment: meta.environment,
+            taskRolePolicyStatements,
+            executionRolePolicyStatements
+        }, provider);
+        const env = configuration.env || [];
+        const secretsById = (0, collectSecretKeys_1.collectSecretKeys)(env);
+        const allSecrets = await (0, fetchAllSecrets_1.fetchAllSecrets)(secretsById);
+        const environment = (0, resolveEnvSecrets_1.resolveEnvSecrets)(env, allSecrets);
+        const { envSecret, envSecretVersion } = await (0, createEnvSecret_1.createEnvSecret)({
+            id: `${meta.environment}-${config.id}`,
+            environment
+        });
+        const { secrets, environmentVars } = (0, buildEcsSecrets_1.buildEcsSecrets)({
+            environment,
+            envSecret
+        });
+        let ecrRepo = undefined;
+        let ecrRepoLifecycle = undefined;
+        let ecrRepoName = configuration.ecr?.name || configuration.dockerBuild?.repositoryName || `${configuration.name}-ecr-repo`;
+        if (configuration.ecr?.enabled) {
+            const { repo, repoLifecycle } = await (0, createEcrRepo_1.createEcrRepo)(`${meta.environment}-${ecrRepoName}`, meta.environment, configuration.tags, configuration.ecr.lifecyclePolicy, configuration.ecr);
+            ecrRepo = repo;
+            ecrRepoLifecycle = repoLifecycle;
+        }
+        if (configuration.dockerBuild && configuration.dockerBuild.context) {
+            if (!ecrRepo) {
+                throw new Error("ECR repo must be created for dockerBuild. Check your configuration.ecr block.");
+            }
+            const ecrCreds = aws.ecr.getAuthorizationTokenOutput({});
+            const image = (0, buildAndPushDockerImage_1.buildAndPushDockerImage)({
+                name: configuration.name,
+                environment: meta.environment,
+                repoUrl: ecrRepo.repositoryUrl,
+                dockerBuild: configuration.dockerBuild,
+                ecrCreds
+            });
+            configuration.image = image.imageName;
+            image.imageName.apply(img => {
+            });
+        }
+        const region = meta.region;
+        const logGroupName = `/ecs/${meta.environment}-${configuration.name}`;
+        const retentionInDays = configuration.logging?.retentionInDays || 365;
+        const logGroup = (0, createLogGroup_1.createLogGroup)(logGroupName, region, retentionInDays, provider);
+        if (configuration.logging?.dataProtection?.enabled) {
+            const dataProtectionPolicy = (0, dataProtectionPolicyBuilder_1.buildDataProtectionPolicy)(configuration.logging.dataProtection, logGroupName, dataProtectionPolicyBuilder_1.DEFAULT_DATA_IDENTIFIERS.ECS_LOGS, "ECS Service");
+            if (dataProtectionPolicy) {
+                new aws.cloudwatch.LogDataProtectionPolicy(`${meta.environment}-${configuration.name}-data-protection`, {
+                    logGroupName: logGroupName,
+                    policyDocument: JSON.stringify(dataProtectionPolicy),
+                }, {
+                    dependsOn: [logGroup],
+                    provider
+                });
+            }
+        }
+        const redeployEnv = (0, buildForceRedeployEnv_1.buildForceRedeployEnv)(configuration.forceRedeploy);
+        const baseContainer = {
+            name: `${meta.environment}-${configuration.name}`,
+            image: configuration.image,
+            portMappings: [{ containerPort: configuration.port }],
+            environment: [],
+            secrets: [],
+            logConfiguration: {
+                logDriver: "awslogs",
+                options: {
+                    "awslogs-group": logGroupName,
+                    "awslogs-region": region,
+                    "awslogs-stream-prefix": "ecs"
+                }
+            }
+        };
+        const containerDef = pulumi.all([
+            environmentVars,
+            secrets,
+            configuration.image
+        ]).apply(([envVars, secrets, image]) => {
+            let container = { ...baseContainer, image, environment: [...envVars, ...redeployEnv], secrets };
+            if (config.containerTemplate) {
+                container = config.containerTemplate(container, config);
+            }
+            return JSON.stringify([container]);
+        });
+        const taskDef = (0, createTaskDefinition_1.createTaskDefinition)({
+            name: `${meta.environment}-${configuration.name}`,
+            cpu: configuration.cpu,
+            memory: configuration.memory,
+            executionRoleArn: executionRole.arn,
+            taskRoleArn: taskRole.arn,
+            containerDefinitions: containerDef,
+            dependsOn: [logGroup]
+        }, provider);
+        if (!tg) {
+            throw new Error("Target group must be created for ECS service. Check your configuration.");
+        }
+        const service = (0, createEcsService_1.createEcsService)({
+            name: `${meta.environment}-${configuration.name}`,
+            cluster: inputs.clusterArn,
+            taskDefinition: taskDef.arn,
+            desiredCount: configuration.desiredCount,
+            launchType: configuration.launchType || "FARGATE",
+            networkConfiguration: {
+                subnets: inputs.subnets,
+                securityGroups: [inputs.sgId || pulumi.output("")]
+            },
+            loadBalancers: [
+                {
+                    targetGroupArn: tg.arn,
+                    containerName: `${meta.environment}-${configuration.name}`,
+                    containerPort: configuration.port
+                }
+            ],
+            deploymentCircuitBreaker: configuration.circuitBreaker && configuration.circuitBreaker.enabled ? {
+                enable: configuration.circuitBreaker.enable !== false,
+                rollback: configuration.circuitBreaker.rollback !== false
+            } : undefined,
+            dependsOn: [
+                tg,
+                ...listenerRules
+            ]
+        });
+        if (config.hooks?.beforeCreateTaskDef) {
+            await config.hooks.beforeCreateTaskDef(config);
+        }
+        if (envSecret) {
+            (0, attachSecretAccessPolicy_1.attachSecretAccessPolicy)({
+                name: `${meta.environment}-${configuration.name}`,
+                role: taskRole,
+                secretArn: envSecret.arn
+            });
+            (0, attachSecretAccessPolicy_1.attachSecretAccessPolicy)({
+                name: `${meta.environment}-${configuration.name}` + "-exec",
+                role: executionRole,
+                secretArn: envSecret.arn
+            });
+            service.envSecret = envSecret;
+        }
+        if (ecrRepo) {
+            service.ecrRepo = ecrRepo;
+        }
+        let scalingTarget, scalingPolicies;
+        if (configuration.autoScaling?.enabled || configuration.minCapacity || configuration.maxCapacity) {
+            const autoScalingConfig = {
+                enabled: configuration.autoScaling?.enabled ?? true,
+                minCapacity: configuration.autoScaling?.minCapacity || configuration.minCapacity || 1,
+                maxCapacity: configuration.autoScaling?.maxCapacity || configuration.maxCapacity || 10,
+                targetCPUUtilization: configuration.autoScaling?.targetCPUUtilization || 70,
+                targetMemoryUtilization: configuration.autoScaling?.targetMemoryUtilization || 80,
+                scaleInCooldown: configuration.autoScaling?.scaleInCooldown || 300,
+                scaleOutCooldown: configuration.autoScaling?.scaleOutCooldown || 300,
+            };
+            const staticServiceName = `${meta.environment}-${configuration.name}`;
+            const autoScaling = createAutoScaling(service, pulumi.output(inputs.clusterArn).apply(arn => arn.split('/').pop() || ''), autoScalingConfig, staticServiceName, provider);
+            scalingTarget = autoScaling.scalingTarget;
+            scalingPolicies = autoScaling.policies;
+            service.scalingTarget = scalingTarget;
+            service.scalingPolicies = scalingPolicies;
+        }
+        if (config.hooks?.afterCreateService) {
+            await config.hooks.afterCreateService(service, config);
+        }
+        return service;
+    }
+    getOutputs(resource) {
+        return {
+            id: resource.id,
+            name: resource.name,
+            secretArn: resource.envSecret ? resource.envSecret.arn : undefined,
+            ecrRepositoryUrl: resource.ecrRepo ? resource.ecrRepo.repositoryUrl : undefined,
+            ecrRepositoryArn: resource.ecrRepo ? resource.ecrRepo.arn : undefined,
+            scalingTargetArn: resource.scalingTarget ? resource.scalingTarget.arn : undefined,
+        };
+    }
+    validateConfig(config) {
+        if (!config.configuration || !config.configuration.name) {
+            throw new Error("Service config must include configuration with name");
+        }
+    }
+}
+exports.ServiceFactory = ServiceFactory;