aws-cdk-constructs 2.22.2__tar.gz → 2.24.0__tar.gz

{aws_cdk_constructs-2.22.2 → aws_cdk_constructs-2.24.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: aws_cdk_constructs
-Version: 2.22.2
+Version: 2.24.0
 Summary: AWS CDK constructs
 Home-page: https://bitbucket.org/cioapps/aws-cdk-constructs
 Author: author

{aws_cdk_constructs-2.22.2 → aws_cdk_constructs-2.24.0}/aws_cdk_constructs/__init__.py

@@ -1,6 +1,7 @@
 """aws_cdk_constructs package."""
 from .microservice import Microservice
 from .database import Database
+from .database import DatabaseType
 from .bucket import Bucket
 from .ecs.cluster import ECSCluster
 from .ecs.microservice import ECSMicroservice
@@ -12,4 +13,4 @@ from .load_balancer import Alb, Nlb
 from .security_group import SecurityGroup
 from .windows_server import WindowsServer
 
-__version__ = '2.22.2'
+__version__ = '2.24.0'

{aws_cdk_constructs-2.22.2 → aws_cdk_constructs-2.24.0}/aws_cdk_constructs/bucket/bucket.py

@@ -8,6 +8,9 @@ from aws_cdk import (
     aws_kms as _kms,
     aws_route53 as route53,
     aws_route53_targets as route53_targets,
+    aws_cloudfront as _cloudfront,
+    aws_cloudfront_origins as _cloudfront_origins,
+    aws_certificatemanager as _certificate,
 )
 import boto3
 from aws_cdk_constructs.utils import (
@@ -93,6 +96,13 @@ class Bucket(Construct):
         bucket_enforces_ssl(str): Whether to enforce SSL for the CloudFront distribution. Default: false
 
         omit_cloudformation_template_outputs(bool): Omit the generation of CloudFormation template outputs. Default: false
+
+        will_implement_cdn (str): Whether or not a CloudFront distribution should be deployed in front of the load balancer. Only applicable when an Application Load Balancer is in use
+
+        cdn_domain_names ([str]): If "will_implement_cdn" is "True", it specifies the domain names to associate to the CloudFront distribution. Please make sure that tha provided domain names match the SSL certificate in use
+
+        cdn_ssl_certificate_arn (str): If "will_implement_cdn" is "True" and you want to enable HTTPS for your CloudFront distribution, specify the SSL certificate ARN to use. NB: this certificate must be in North Virginia
+
     """
 
     @property
@@ -104,6 +114,17 @@ class Bucket(Construct):
         """
         return self.bucket
 
+    @property
+    def cloudfront_distribution(
+        self,
+    ) -> Union[_cloudfront.IDistribution, None]:
+        """Returns the CloudFront distribution, if available
+
+        Returns:
+            aws_cloudfront.IDistribution: the Cloudfront distribution
+        """
+        return self._cloudfront_distribution
+
     def create_bucket(
         self,
         logic_id: str,
@@ -116,7 +137,7 @@ class Bucket(Construct):
         removal_policy: aws_cdk.RemovalPolicy = None,
         versioned: bool = False,
         is_encrypted: bool = False,
-        encryption_allowed_principals_arns: Union[str, List[str]] = None,
+        encryption_allowed_principals_arns: [str, List[str]] = None,
         enforce_ssl: bool = False,
         **kwargs,
     ):
@@ -138,6 +159,9 @@ class Bucket(Construct):
         is_encrypted: bool = False,
         encryption_allowed_principals_arns: Union[str, List[str]] = None,
         enforce_ssl: bool = False,
+        will_implement_cdn: str = 'false',
+        cdn_domain_names: [str] = [],
+        cdn_ssl_certificate_arn: str = None,
         **kwargs,
     ) -> aws_cdk.aws_s3.Bucket:
         """Create an S3 bucket
@@ -168,6 +192,12 @@ class Bucket(Construct):
 
             enforce_ssl(Bool): Whether to enforce SSL for the CloudFront distribution. Default: false
 
+            will_implement_cdn (str): Whether or not a CloudFront distribution should be deployed in front of the load balancer. Only applicable when an Application Load Balancer is in use
+
+            cdn_domain_names ([str]): If "will_implement_cdn" is "True", it specifies the domain names to associate to the CloudFront distribution. Please make sure that tha provided domain names match the SSL certificate in use
+
+            cdn_ssl_certificate_arn (str): If "will_implement_cdn" is "True" and you want to enable HTTPS for your CloudFront distribution, specify the SSL certificate ARN to use. NB: this certificate must be in North Virginia
+
         Returns:
             aws_s3.Bucket: the S3 bucket
         """
@@ -262,6 +292,37 @@ class Bucket(Construct):
                 record_name=f'{dns_record}.{domain_name}',
             )
 
+        create_cloudfront_distribution = (
+            will_implement_cdn
+            and isinstance(will_implement_cdn, str)
+            and will_implement_cdn.lower() == 'true'
+        )
+        # Create CloudFront distribution
+        if create_cloudfront_distribution:
+            self._cloudfront_distribution = _cloudfront.Distribution(
+                self,
+                f'distribution_{bucket_name}',
+                default_behavior=_cloudfront.BehaviorOptions(
+                    origin=_cloudfront_origins.S3Origin(s3_bucket),
+                    compress=True,
+                    viewer_protocol_policy=_cloudfront.ViewerProtocolPolicy.HTTPS_ONLY,
+                    allowed_methods=_cloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS,
+                    cache_policy=_cloudfront.CachePolicy.CACHING_DISABLED,
+                    origin_request_policy=_cloudfront.OriginRequestPolicy.ALL_VIEWER,
+                ),
+                certificate=_certificate.Certificate.from_certificate_arn(
+                    self,
+                    'https_certificate_cdn',
+                    certificate_arn=cdn_ssl_certificate_arn
+                    if cdn_ssl_certificate_arn
+                    else self.aws_account[
+                        'ssl_certificate_star_fao_org_arn_north_virginia'
+                    ],
+                ),
+                price_class=_cloudfront.PriceClass.PRICE_CLASS_100,
+                domain_names=cdn_domain_names,
+            )
+
         return s3_bucket
 
     def __init__(
@@ -285,6 +346,9 @@ class Bucket(Construct):
         cdn_http_headers: Dict[str, str] = None,
         bucket_enforces_ssl: bool = False,
         omit_cloudformation_template_outputs: bool = False,
+        will_implement_cdn: str = 'false',
+        cdn_domain_names: [str] = [],
+        cdn_ssl_certificate_arn: str = None,
         **kwargs,
     ) -> None:
         super().__init__(scope, id, **kwargs)
@@ -411,6 +475,9 @@ class Bucket(Construct):
             is_encrypted=is_encrypted,
             encryption_allowed_principals_arns=encryption_allowed_principals_arns,
             enforce_ssl=enforce_ssl,
+            will_implement_cdn=will_implement_cdn,
+            cdn_domain_names=cdn_domain_names,
+            cdn_ssl_certificate_arn=cdn_ssl_certificate_arn,
         )
 
         if bucket_is_privately_accessed_from_vpc_over_http:

aws_cdk_constructs-2.24.0/aws_cdk_constructs/database/__init__.py

@@ -0,0 +1,2 @@
+from .database import Database
+from .database import DatabaseType

aws_cdk_constructs-2.24.0/aws_cdk_constructs/database/_types/__init__.py

@@ -0,0 +1 @@
+from .relational import RelationalDatabase

aws_cdk_constructs-2.24.0/aws_cdk_constructs/database/_types/graph.py

@@ -0,0 +1,185 @@
+from aws_cdk import (
+    aws_neptune_alpha as _neptune,
+    aws_ec2 as _ec2,
+    aws_kms as _kms,
+    aws_route53 as route53,
+    RemovalPolicy as removal_policy,
+    aws_logs as _logs,
+)
+import aws_cdk as cdk
+from typing import Union, List
+
+
+def GraphDatabase(
+    scope,
+    app_name: str,
+    environment: str,
+    environments_parameters: dict,
+    vpc: _ec2.Vpc,
+    security_groups: List[_ec2.SecurityGroup],
+    database_instance_type: str,
+    database_identifier: str,
+    is_production: bool,
+    is_ha: bool,
+    parameter_group: _neptune.ParameterGroup = None,
+    database_engine_version: Union[str, _neptune.EngineVersion] = None,
+    database_cluster_parameters_group_name: str = None,
+    database_identifier_postfix: str = '',
+    create_dns: str = 'True',
+    tag_scheduler_uptime: str = '',
+    tag_scheduler_uptime_days: str = '',
+    tag_scheduler_uptime_skip: str = '',
+    cloudwatch_audit_log: str = None,
+    dns_record: str = None,
+):
+    environment = environment.lower()
+    aws_account = environments_parameters['accounts'][environment]
+    account_id = aws_account['id']
+
+    is_not_production = not is_production
+
+    _cluster = None
+
+    # ~~~~~~~~~~~~~~~~
+    # RDS Instance type
+    # ~~~~~~~~~~~~~~~~
+    instance_type = _neptune.InstanceType.of(database_instance_type)
+
+    # ~~~~~~~~~~~~~~~~
+    # KMS Encryption key
+    # ~~~~~~~~~~~~~~~~
+    key_arn = (
+        'arn:aws:kms:eu-west-1:'
+        + account_id
+        + ':key/'
+        + aws_account['kms_neptune_key']
+    )
+    encryption_key = _kms.Key.from_key_arn(scope, 'encryption_key', key_arn)
+
+    # ~~~~~~~~~~~~~~~~
+    # Neptune Logs
+    # ~~~~~~~~~~~~~~~~
+    # Default Neptune cloudwatch logs export in NONE
+    cloudwatch_logs_exports = None
+    should_be_cloudwatch_audit_log = (
+        cloudwatch_audit_log
+        and isinstance(cloudwatch_audit_log, str)
+        and cloudwatch_audit_log.lower() == 'true'
+    )
+
+    if should_be_cloudwatch_audit_log:
+        # If user specified change to cloud watch log setting
+        cloudwatch_logs_exports = [_neptune.LogType.AUDIT]
+
+    # ~~~~~~~~~~~~~~~~
+    # Neptune Parameter group
+    # ~~~~~~~~~~~~~~~~
+    default_cluster_params = {}
+    if should_be_cloudwatch_audit_log:
+        default_cluster_params.update({'neptune_enable_audit_log': '1'})
+
+    my_parameter_group = parameter_group or _neptune.ClusterParameterGroup(
+        scope,
+        f'{app_name}cluster_params',
+        description=f'{app_name} - Cluster parameter group',
+        parameters=default_cluster_params,
+        family=_neptune.ParameterGroupFamily.NEPTUNE_1_2,
+    )
+
+    my_engine_version = (
+        database_engine_version
+        if database_engine_version
+        else _neptune.EngineVersion.V1_2_1_0
+    )
+
+    # ~~~~~~~~~~~~~~~~
+    # Neptune Cluster
+    # ~~~~~~~~~~~~~~~~
+    _cluster = _neptune.DatabaseCluster(
+        scope,
+        'cluster',
+        instance_type=instance_type,
+        vpc=vpc,
+        # associated_roles=None,
+        auto_minor_version_upgrade=False,
+        backup_retention=cdk.Duration.days(30),
+        cloudwatch_logs_exports=cloudwatch_logs_exports,
+        cloudwatch_logs_retention=_logs.RetentionDays.ONE_MONTH,
+        # cloudwatch_logs_retention_role=None, # Create a new role
+        cluster_parameter_group=my_parameter_group,
+        db_cluster_name=database_identifier + 'cluster',
+        deletion_protection=is_production,
+        engine_version=my_engine_version,
+        # iam_authentication=None
+        instance_identifier_base=database_identifier,
+        instances=2 if is_ha else 1,
+        kms_key=encryption_key,
+        # parameter_group=None TODO: implement when this will be needed
+        preferred_backup_window='01:00-02:00',
+        preferred_maintenance_window='mon:03:00-mon:04:00',
+        removal_policy=removal_policy.RETAIN
+        if is_production
+        else removal_policy.DESTROY,
+        security_groups=security_groups,
+        storage_encrypted=True,
+        # subnet_group=None, # Use default value, create a new subnet group
+        # vpc_subnets=None, # Do not specify to host the db in the private subnets
+    )
+
+    if not is_production and create_dns.lower() == 'true':
+        # Create DNS record
+        cluster_hostname = str(_cluster.cluster_endpoint)
+        cluster_hostname = ''.join(cluster_hostname.split())
+
+        hosted_zone_id = aws_account['route53_hosted_zone_id']
+        domain_name = aws_account['route53_domain_name']
+
+        dns_record = 'db.' + app_name if app_name else dns_record
+        dns_record = (
+            dns_record + '-' + database_identifier_postfix
+            if database_identifier_postfix
+            else dns_record
+        )
+        route53_zone = route53.PrivateHostedZone.from_hosted_zone_attributes(
+            scope,
+            f'RDSPrivateHostedZone{dns_record}',
+            hosted_zone_id=hosted_zone_id,
+            zone_name=domain_name,
+        )
+        route53.CnameRecord(
+            scope,
+            f'RDSAliasRecord{dns_record}',
+            zone=route53_zone,
+            # target=cdk.Token.as_string(self._cluster.cluster_endpoint), # << Not working here
+            # target=route53.RecordTarget.from_values(self._cluster.cluster_endpoint.hostname),
+            domain_name=cluster_hostname,
+            record_name=f'{dns_record}.{domain_name}',
+        )
+
+    # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FAO AWS Scheduler tags
+    if is_not_production:
+        clus = _cluster.node.find_child('Resource')
+        instance = _cluster.node.find_child('Instance1')
+
+        if tag_scheduler_uptime_skip:
+            cdk.Tags.of(clus).add('SchedulerSkip', tag_scheduler_uptime_skip)
+            cdk.Tags.of(instance).add(
+                'SchedulerSkip', tag_scheduler_uptime_skip
+            )
+
+        if tag_scheduler_uptime:
+            cdk.Tags.of(clus).add('SchedulerUptime', tag_scheduler_uptime)
+            cdk.Tags.of(instance).add('SchedulerUptime', tag_scheduler_uptime)
+
+        if tag_scheduler_uptime_days:
+            cdk.Tags.of(clus).add(
+                'SchedulerUptimeDays', tag_scheduler_uptime_days
+            )
+            cdk.Tags.of(instance).add(
+                'SchedulerUptimeDays', tag_scheduler_uptime_days
+            )
+
+    # ~~~~~~~~~~~~~~~~
+    # Return
+    # ~~~~~~~~~~~~~~~~
+    return _cluster