token-injectable-docker-builder 0.1.6 → 1.0.0

package/lib/index.ts

@@ -1,220 +0,0 @@
-import * as path from 'path';
-import { Duration, CustomResource, Stack } from 'aws-cdk-lib';
-import { Project, Source, LinuxBuildImage, BuildSpec } from 'aws-cdk-lib/aws-codebuild';
-import { Repository } from 'aws-cdk-lib/aws-ecr';
-import { PolicyStatement } from 'aws-cdk-lib/aws-iam';
-import { Code, DockerImageCode, Runtime } from 'aws-cdk-lib/aws-lambda';
-import { Asset } from 'aws-cdk-lib/aws-s3-assets';
-import { Provider } from 'aws-cdk-lib/custom-resources';
-import { Construct } from 'constructs';
-import { ContainerImage } from 'aws-cdk-lib/aws-ecs';
-import * as crypto from 'crypto';
-import { Function } from 'aws-cdk-lib/aws-lambda';
-
-
-/**
- * Properties for the `TokenInjectableDockerBuilder` construct.
- */
-export interface TokenInjectableDockerBuilderProps {
-  /**
-   * The path to the directory containing the Dockerfile or source code.
-   */
-  path: string;
-
-  /**
-   * Build arguments to pass to the Docker build process.
-   * These are transformed into `--build-arg` flags.
-   * @example
-   * {
-   *   TOKEN: 'my-secret-token',
-   *   ENV: 'production'
-   * }
-   */
-  buildArgs?: { [key: string]: string };
-}
-
-
-/**
- * A CDK construct to build and push Docker images to an ECR repository using CodeBuild and Lambda custom resources.
- *
- * @example
- * const dockerBuilder = new TokenInjectableDockerBuilder(this, 'DockerBuilder', {
- *   path: './docker',
- *   buildArgs: {
- *     TOKEN: 'my-secret-token',
- *     ENV: 'production'
- *   },
- * });
- *
- * const containerImage = dockerBuilder.getContainerImage();
- */
-export class TokenInjectableDockerBuilder extends Construct {
-  private readonly ecrRepository: Repository;
-  private readonly buildTriggerResource: CustomResource;
-
-  /**
-   * Creates a new `TokenInjectableDockerBuilder` instance.
-   *
-   * @param scope The parent construct/stack.
-   * @param id The unique ID of the construct.
-   * @param props Configuration properties for the construct.
-   */
-  constructor(scope: Construct, id: string, props: TokenInjectableDockerBuilderProps) {
-    super(scope, id);
-
-    const { path: sourcePath, buildArgs } = props; // Default to linux/amd64
-
-    // Define absolute paths for Lambda handlers
-    const onEventHandlerPath = path.resolve(__dirname, '../src/onEventHandler');
-    const isCompleteHandlerPath = path.resolve(__dirname, '../src/isCompleteHandler');
-
-    // Create an ECR repository
-    this.ecrRepository = new Repository(this, 'ECRRepository');
-
-    // Package the source code as an asset
-    const sourceAsset = new Asset(this, 'SourceAsset', {
-      path: sourcePath, // Path to the Dockerfile or source code
-    });
-
-    // Transform buildArgs into a string of --build-arg KEY=VALUE
-    const buildArgsString = buildArgs
-      ? Object.entries(buildArgs)
-        .map(([key, value]) => `--build-arg ${key}=${value}`)
-        .join(' ')
-      : '';
-
-    // Pass the buildArgsString and platform as environment variables
-    const environmentVariables: { [name: string]: { value: string } } = {
-      ECR_REPO_URI: { value: this.ecrRepository.repositoryUri },
-      BUILD_ARGS: { value: buildArgsString },
-    };
-
-    // Create a CodeBuild project
-    const codeBuildProject = new Project(this, 'UICodeBuildProject', {
-      source: Source.s3({
-        bucket: sourceAsset.bucket,
-        path: sourceAsset.s3ObjectKey,
-      }),
-      environment: {
-        buildImage: LinuxBuildImage.STANDARD_7_0,
-        privileged: true, // Required for Docker builds
-      },
-      environmentVariables: environmentVariables,
-      buildSpec: BuildSpec.fromObject({
-        version: '0.2',
-        phases: {
-          pre_build: {
-            commands: [
-              'echo "Retrieving AWS Account ID..."',
-              'export ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)',
-              'echo "Logging in to Amazon ECR..."',
-              'aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com',
-            ],
-          },
-          build: {
-            commands: [
-              'echo Build phase: Building the Docker image...',
-              'docker build $BUILD_ARGS -t $ECR_REPO_URI:latest $CODEBUILD_SRC_DIR',
-            ],
-          },
-          post_build: {
-            commands: [
-              'echo Post-build phase: Pushing the Docker image...',
-              'docker push $ECR_REPO_URI:latest',
-            ],
-          },
-        },
-      }),
-    });
-
-    // Grant permissions to interact with ECR
-    this.ecrRepository.grantPullPush(codeBuildProject);
-
-    codeBuildProject.role!.addToPrincipalPolicy(
-      new PolicyStatement({
-        actions: ['ecr:GetAuthorizationToken'],
-        resources: ['*'],
-      })
-    );
-
-    // Grant permissions to CodeBuild for CloudWatch Logs
-    codeBuildProject.role!.addToPrincipalPolicy(
-      new PolicyStatement({
-        actions: ['logs:PutLogEvents', 'logs:CreateLogGroup', 'logs:CreateLogStream'],
-        resources: [`arn:aws:logs:${Stack.of(this).region}:${Stack.of(this).account}:*`],
-      })
-    );
-
-    // Create Node.js Lambda function for onEvent
-    const onEventHandlerFunction = new Function(this, 'OnEventHandlerFunction', {
-      runtime: Runtime.NODEJS_LATEST, // Use Node.js runtime
-      code: Code.fromAsset(onEventHandlerPath), // Path to handler code
-      handler: 'index.handler', // Entry point (adjust as needed)
-      timeout: Duration.minutes(15),
-    });
-
-    onEventHandlerFunction.addToRolePolicy(
-      new PolicyStatement({
-        actions: ['codebuild:StartBuild'],
-        resources: [codeBuildProject.projectArn], // Restrict to specific project
-      })
-    );
-
-    // Create Node.js Lambda function for isComplete
-    const isCompleteHandlerFunction = new Function(this, 'IsCompleteHandlerFunction', {
-      runtime: Runtime.NODEJS_LATEST,
-      code: Code.fromAsset(isCompleteHandlerPath),
-      handler: 'index.handler',
-      timeout: Duration.minutes(15),
-    });
-
-    isCompleteHandlerFunction.addToRolePolicy(
-      new PolicyStatement({
-        actions: [
-          'codebuild:BatchGetBuilds',
-          'codebuild:ListBuildsForProject',
-          'logs:GetLogEvents',
-          'logs:DescribeLogStreams',
-          'logs:DescribeLogGroups'
-        ],
-        resources: ['*'],
-      })
-    );
-
-    // Create a custom resource provider
-    const provider = new Provider(this, 'CustomResourceProvider', {
-      onEventHandler: onEventHandlerFunction,
-      isCompleteHandler: isCompleteHandlerFunction,
-      queryInterval: Duration.minutes(1),
-    });
-
-    // Define the custom resource
-    this.buildTriggerResource = new CustomResource(this, 'BuildTriggerResource', {
-      serviceToken: provider.serviceToken,
-      properties: {
-        ProjectName: codeBuildProject.projectName,
-        Trigger: crypto.randomUUID(),
-      },
-    });
-
-    this.buildTriggerResource.node.addDependency(codeBuildProject);
-  }
-
-  /**
-   * Retrieves the container image from the ECR repository.
-   *
-   * @returns A `ContainerImage` object representing the built image.
-   */
-  public getContainerImage(): ContainerImage {
-    return ContainerImage.fromEcrRepository(this.ecrRepository, 'latest');
-  }
-
-  /**
-   * Retrieves the Docker image code for use in AWS Lambda.
-   *
-   * @returns A `DockerImageCode` object for the Docker image.
-   */
-  public getDockerImageCode(): DockerImageCode {
-    return DockerImageCode.fromEcr(this.ecrRepository);
-  }
-}

package/src/isCompleteHandler/index.js

@@ -1,97 +0,0 @@
-const { CodeBuildClient, ListBuildsForProjectCommand, BatchGetBuildsCommand } = require('@aws-sdk/client-codebuild');
-const { CloudWatchLogsClient, GetLogEventsCommand } = require('@aws-sdk/client-cloudwatch-logs');
-
-exports.handler = async (event, context) => {
-    console.log('isCompleteHandler Event:', JSON.stringify(event, null, 2));
-
-    // Initialize AWS SDK v3 clients
-    const codebuildClient = new CodeBuildClient({ region: process.env.AWS_REGION });
-    const cloudwatchlogsClient = new CloudWatchLogsClient({ region: process.env.AWS_REGION });
-
-    try {
-        const projectName = event.ResourceProperties.ProjectName;
-
-        if (!projectName) {
-            throw new Error('ProjectName is required in ResourceProperties');
-        }
-
-        console.log(`Checking status for CodeBuild project: ${projectName}`);
-
-        // Retrieve the latest build for the given project
-        const listBuildsCommand = new ListBuildsForProjectCommand({
-            projectName: projectName,
-            sortOrder: 'DESCENDING',
-            maxResults: 1,
-        });
-
-        const listBuildsResp = await codebuildClient.send(listBuildsCommand);
-        const buildIds = listBuildsResp.ids;
-
-        if (!buildIds || buildIds.length === 0) {
-            throw new Error(`No builds found for project: ${projectName}`);
-        }
-
-        const buildId = buildIds[0];
-        console.log(`Latest Build ID: ${buildId}`);
-
-        // Get build details
-        const batchGetBuildsCommand = new BatchGetBuildsCommand({
-            ids: [buildId],
-        });
-
-        const buildDetailsResp = await codebuildClient.send(batchGetBuildsCommand);
-        const build = buildDetailsResp.builds[0];
-
-        if (!build) {
-            throw new Error(`Build details not found for Build ID: ${buildId}`);
-        }
-
-        const buildStatus = build.buildStatus;
-        console.log(`Build Status: ${buildStatus}`);
-
-        if (buildStatus === 'IN_PROGRESS') {
-            // Build is still in progress
-            console.log('Build is still in progress.');
-            return { IsComplete: false };
-        } else if (buildStatus === 'SUCCEEDED') {
-            // Build succeeded
-            console.log('Build succeeded.');
-            return { IsComplete: true };
-        } else if (['FAILED', 'FAULT', 'STOPPED', 'TIMED_OUT'].includes(buildStatus)) {
-            // Build failed; retrieve last 5 log lines
-            const logsInfo = build.logs;
-            if (logsInfo && logsInfo.groupName && logsInfo.streamName) {
-                console.log(`Retrieving logs from CloudWatch Logs Group: ${logsInfo.groupName}, Stream: ${logsInfo.streamName}`);
-
-                const getLogEventsCommand = new GetLogEventsCommand({
-                    logGroupName: logsInfo.groupName,
-                    logStreamName: logsInfo.streamName,
-                    startFromHead: false, // Start from the end to get latest logs
-                    limit: 5,
-                });
-
-                const logEventsResp = await cloudwatchlogsClient.send(getLogEventsCommand);
-                const logEvents = logEventsResp.events;
-                const lastFiveMessages = logEvents.map((event) => event.message).reverse().join('\n');
-
-                const errorMessage = `Build failed with status: ${buildStatus}\nLast 5 build logs:\n${lastFiveMessages}`;
-                console.error(errorMessage);
-
-                // Throw an error to indicate failure to the CDK provider
-                throw new Error(errorMessage);
-            } else {
-                const errorMessage = `Build failed with status: ${buildStatus}, but logs are not available.`;
-                console.error(errorMessage);
-                throw new Error(errorMessage);
-            }
-        } else {
-            const errorMessage = `Unknown build status: ${buildStatus}`;
-            console.error(errorMessage);
-            throw new Error(errorMessage);
-        }
-    } catch (error) {
-        console.error('Error in isCompleteHandler:', error);
-        // Rethrow the error to inform the CDK provider of the failure
-        throw error;
-    }
-};

package/src/onEventHandler/index.js

@@ -1,39 +0,0 @@
-const { CodeBuildClient, StartBuildCommand } = require('@aws-sdk/client-codebuild');
-
-exports.handler = async (event, context) => {
-    console.log('Event:', JSON.stringify(event, null, 2));
-
-    // Initialize the AWS SDK v3 CodeBuild client
-    const codebuildClient = new CodeBuildClient({ region: process.env.AWS_REGION });
-
-    // Set the PhysicalResourceId
-    let physicalResourceId = event.PhysicalResourceId || event.LogicalResourceId;
-
-    if (event.RequestType === 'Create' || event.RequestType === 'Update') {
-        const params = {
-            projectName: event.ResourceProperties.ProjectName,
-        };
-
-        try {
-            const command = new StartBuildCommand(params); // Create the command
-            const build = await codebuildClient.send(command); // Send the command
-            console.log('Started build:', JSON.stringify(build, null, 2));
-        } catch (error) {
-            console.error('Error starting build:', error);
-
-            return {
-                PhysicalResourceId: physicalResourceId,
-                Data: {},
-                Reason: error.message,
-            };
-        }
-    } else if (event.RequestType === 'Delete') {
-        // No action needed for delete, but ensure PhysicalResourceId remains the same
-        console.log('Delete request received. No action required.');
-    }
-
-    return {
-        PhysicalResourceId: physicalResourceId,
-        Data: {},
-    };
-};

package/tsconfig.json

@@ -1,31 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2020",
-    "module": "commonjs",
-    "lib": [
-      "es2020",
-      "dom"
-    ],
-    "declaration": true,
-    "strict": true,
-    "noImplicitAny": true,
-    "strictNullChecks": true,
-    "noImplicitThis": true,
-    "alwaysStrict": true,
-    "noUnusedLocals": false,
-    "noUnusedParameters": false,
-    "noImplicitReturns": true,
-    "noFallthroughCasesInSwitch": false,
-    "inlineSourceMap": true,
-    "inlineSources": true,
-    "experimentalDecorators": true,
-    "strictPropertyInitialization": false,
-    "typeRoots": [
-      "./node_modules/@types"
-    ]
-  },
-  "exclude": [
-    "node_modules",
-    "cdk.out"
-  ]
-}