aws-cdk-constructs 2.41.0__tar.gz → 2.41.1__tar.gz

{aws_cdk_constructs-2.41.0/aws_cdk_constructs.egg-info → aws_cdk_constructs-2.41.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws_cdk_constructs
-Version: 2.41.0
+Version: 2.41.1
 Summary: AWS CDK constructs
 Home-page: https://bitbucket.org/cioapps/aws-cdk-constructs
 Author: author

{aws_cdk_constructs-2.41.0 → aws_cdk_constructs-2.41.1}/aws_cdk_constructs/__init__.py

@@ -15,4 +15,4 @@ from .load_balancer import Alb, Nlb
 from .security_group import SecurityGroup
 from .windows_server import WindowsServer
 
-__version__ = '2.41.0'
+__version__ = '2.41.1'

{aws_cdk_constructs-2.41.0 → aws_cdk_constructs-2.41.1}/aws_cdk_constructs/bucket/edge_function.py

@@ -113,7 +113,7 @@ class EdgeFunction(BaseEdgeConstruct):
         edge_function = aws_lambda.Function(
             self._edge_stack,
             name + 'Function',
-            runtime=aws_lambda.Runtime.NODEJS_18_X,
+            runtime=aws_lambda.Runtime.NODEJS_22_X,
             handler='index.handler',
             code=code,
             role=role.role,

{aws_cdk_constructs-2.41.0 → aws_cdk_constructs-2.41.1}/aws_cdk_constructs/bucket/secret_generator.py

@@ -31,7 +31,7 @@ class SecretGenerator(
             self,
             'Function',
             uuid='cloudcomponents-cdk-cloudfront-authorization-secret-generator',
-            runtime=aws_cdk.aws_lambda.Runtime.NODEJS_18_X,
+            runtime=aws_cdk.aws_lambda.Runtime.NODEJS_22_X,
             handler='index.handler',
             code=aws_cdk.aws_lambda.Code.from_asset(
                 path=os.path.join(dirname, '../lambdas/secret-generator/')

{aws_cdk_constructs-2.41.0 → aws_cdk_constructs-2.41.1}/aws_cdk_constructs/bucket/with_configuration.py

@@ -37,7 +37,7 @@ class WithConfiguration(Construct):
             self,
             'MyHandler',
             uuid='cloudcomponents-cdk-lambda-at-edge-pattern-with-my-configuration',
-            runtime=aws_lambda.Runtime.NODEJS_18_X,
+            runtime=aws_lambda.Runtime.NODEJS_22_X,
             code=aws_lambda.Code.from_asset(
                 os.path.join(dirname, '../lambdas/with_configuration/')
             ),

{aws_cdk_constructs-2.41.0 → aws_cdk_constructs-2.41.1}/aws_cdk_constructs/database/_types/relational.py

@@ -4,6 +4,8 @@ from aws_cdk import (
     aws_kms as _kms,
     aws_route53 as route53,
     aws_iam as _iam,
+    aws_logs as _logs,
+    custom_resources as _cr,
 )
 import aws_cdk as cdk
 from typing import Union, List
@@ -190,6 +192,53 @@ def RelationalDatabase(
         else database_engine_version
     )
 
+    should_be_cloudwatch_audit_log = (
+        cloudwatch_audit_log
+        and isinstance(cloudwatch_audit_log, str)
+        and cloudwatch_audit_log.lower() == 'true'
+    )
+
+    cloudwatch_logs_exports = None
+    cloudwatch_logs_retention = None
+    if should_be_cloudwatch_audit_log and is_production:
+        logs_service_user = _iam.User(
+            scope,
+            id='logs_service_user',
+            managed_policies=None,
+            user_name=f'SRVUSR-{app_name}_{environment}_logs',
+        )
+        logs_service_user_policies = _iam.ManagedPolicy(
+            scope,
+            'logs_service_user_policies',
+            statements=[
+                # S3 Configuration bucket permissions
+                _iam.PolicyStatement(
+                    actions=[
+                        'logs:GetLogEvents',
+                    ],
+                    resources=[
+                        f'arn:aws:logs:eu-west-1:{account_id}:log-group:/aws/rds/cluster/{app_name}*/audit:*',
+                    ],
+                ),
+                _iam.PolicyStatement(
+                    actions=[
+                        'logs:DescribeLogGroups',
+                        'logs:DescribeLogStreams',
+                    ],
+                    resources=[
+                        f'arn:aws:logs:eu-west-1:{account_id}:log-group::log-stream:',
+                    ],
+                ),
+            ],
+        )
+        logs_service_user.add_managed_policy(logs_service_user_policies)
+        # If user specified change to cloud watch log setting
+        cloudwatch_logs_exports = _rds.cloudwatch_logs_exports = ['audit']
+        cloudwatch_logs_retention = _logs.RetentionDays.TWO_WEEKS
+        if is_not_production:
+            cloudwatch_logs_exports = None
+            cloudwatch_logs_retention = None
+
     # ~~~~~~~~~~~~~~~~
     # RDS Cluster
     # ~~~~~~~~~~~~~~~~
@@ -215,6 +264,8 @@ def RelationalDatabase(
             storage_encryption_key=encryption_key,
             s3_export_buckets=s3_export_buckets,
             s3_import_buckets=s3_import_buckets,
+            cloudwatch_logs_exports=cloudwatch_logs_exports,
+            cloudwatch_logs_retention=cloudwatch_logs_retention,
         )
 
         _cluster.add_rotation_single_user(
@@ -289,6 +340,50 @@ def RelationalDatabase(
                     'SchedulerUptimeDays', tag_scheduler_uptime_days
                 )
 
+        # Tag LogGroup
+        log_group_name = (
+            f'/aws/rds/cluster/{_cluster.cluster_identifier}/audit'
+        )
+        log_group_tags = {
+            'ApplicationName': app_name,
+            'Environment': environment,
+            'DatabaseAuditLog': app_name,
+        }
+        _cr.AwsCustomResource(
+            scope,
+            f'TagClusterLogGroupAudit',
+            on_create=_cr.AwsSdkCall(
+                service='CloudWatchLogs',
+                action='TagLogGroup',
+                parameters={
+                    'logGroupName': log_group_name,
+                    'tags': log_group_tags,
+                },
+                physical_resource_id=_cr.PhysicalResourceId.of(log_group_name),
+            ),
+            on_update=_cr.AwsSdkCall(
+                service='CloudWatchLogs',
+                action='TagLogGroup',
+                parameters={
+                    'logGroupName': log_group_name,
+                    'tags': log_group_tags,
+                },
+                physical_resource_id=_cr.PhysicalResourceId.of(log_group_name),
+            ),
+            on_delete=_cr.AwsSdkCall(
+                service='CloudWatchLogs',
+                action='TagLogGroup',
+                parameters={
+                    'logGroupName': log_group_name,
+                    'tags': log_group_tags,
+                },
+                physical_resource_id=_cr.PhysicalResourceId.of(log_group_name),
+            ),
+            policy=_cr.AwsCustomResourcePolicy.from_sdk_calls(
+                resources=_cr.AwsCustomResourcePolicy.ANY_RESOURCE
+            ),
+        )
+
     # ~~~~~~~~~~~~~~~~
     # RDS Instance
     # ~~~~~~~~~~~~~~~~
@@ -297,7 +392,7 @@ def RelationalDatabase(
         # Default RDS license model is NONE
         license_model = None
         # Default RDS cloudwatch logs export in NONE
-        cloudwatch_logs_exports = None
+        # cloudwatch_logs_exports = None
 
         if is_oracle:
 
@@ -324,18 +419,6 @@ def RelationalDatabase(
                 # If user specified change to BRING_YOUR_OWN_LICENSE
                 license_model = _rds.LicenseModel.BRING_YOUR_OWN_LICENSE
 
-            should_be_cloudwatch_audit_log = (
-                cloudwatch_audit_log
-                and isinstance(cloudwatch_audit_log, str)
-                and cloudwatch_audit_log.lower() == 'true'
-            )
-
-            if should_be_cloudwatch_audit_log:
-                # If user specified change to cloud watch log setting
-                cloudwatch_logs_exports = _rds.cloudwatch_logs_exports = [
-                    'audit'
-                ]
-
         if is_sqlserver:
             # Default SQL server license model is LICENSE_INCLUDED
             license_model = _rds.LicenseModel.LICENSE_INCLUDED
@@ -372,6 +455,7 @@ def RelationalDatabase(
             storage_encryption_key=encryption_key,
             character_set_name=character_set_name,
             cloudwatch_logs_exports=cloudwatch_logs_exports,
+            cloudwatch_logs_retention=cloudwatch_logs_retention,
             s3_export_buckets=s3_export_buckets,
             s3_import_buckets=s3_import_buckets,
         )
@@ -461,6 +545,50 @@ def RelationalDatabase(
                     'SchedulerUptimeDays', tag_scheduler_uptime_days
                 )
 
+        # Tag LogGroup
+        log_group_name = (
+            f'/aws/rds/instance/{_instance.instance_identifier}/audit'
+        )
+        log_group_tags = {
+            'ApplicationName': app_name,
+            'Environment': environment,
+            'DatabaseAuditLog': app_name,
+        }
+        _cr.AwsCustomResource(
+            scope,
+            f'TagInstanceLogGroupAudit',
+            on_create=_cr.AwsSdkCall(
+                service='CloudWatchLogs',
+                action='TagLogGroup',
+                parameters={
+                    'logGroupName': log_group_name,
+                    'tags': log_group_tags,
+                },
+                physical_resource_id=_cr.PhysicalResourceId.of(log_group_name),
+            ),
+            on_update=_cr.AwsSdkCall(
+                service='CloudWatchLogs',
+                action='TagLogGroup',
+                parameters={
+                    'logGroupName': log_group_name,
+                    'tags': log_group_tags,
+                },
+                physical_resource_id=_cr.PhysicalResourceId.of(log_group_name),
+            ),
+            on_delete=_cr.AwsSdkCall(
+                service='CloudWatchLogs',
+                action='TagLogGroup',
+                parameters={
+                    'logGroupName': log_group_name,
+                    'tags': log_group_tags,
+                },
+                physical_resource_id=_cr.PhysicalResourceId.of(log_group_name),
+            ),
+            policy=_cr.AwsCustomResourcePolicy.from_sdk_calls(
+                resources=_cr.AwsCustomResourcePolicy.ANY_RESOURCE
+            ),
+        )
+
     # ~~~~~~~~~~~~~~~~
     # Returns
     # ~~~~~~~~~~~~~~~~

{aws_cdk_constructs-2.41.0 → aws_cdk_constructs-2.41.1}/aws_cdk_constructs/database/database.py

@@ -98,7 +98,7 @@ class Database(Construct):
 
         rubrik_backup (str): to enable/disable Rubrik backup using tag `RubrikBackup` - format Boolean (`true`, `false`). Default: true
 
-        cloudwatch_audit_log (str): Applicable only to Oracle and Neptune instances. Oracle: If to enable audit logs export in S3. The default is no log exports. Specify this param in case you want to have the audit log export enabled. Neptune: if you also pass a custom cluster parameter group remember to add "neptune_enable_audit_log": "1" to it. If no cluster parameter group is provided it will be added automatically.
+        cloudwatch_audit_log (str): Applicable only to relational and Neptune instances. The default is no log exports. Specify this param in case you want to have the audit log export enabled. Neptune: if you also pass a custom cluster parameter group remember to add "neptune_enable_audit_log": "1" to it. If no cluster parameter group is provided it will be added automatically.
 
         dns_record: (Optional | str) The DNS record associated to the Database if multiple Databases
 

{aws_cdk_constructs-2.41.0 → aws_cdk_constructs-2.41.1}/aws_cdk_constructs/ecs/cluster.py

@@ -79,6 +79,8 @@ class ECSCluster(Construct):
             ec2_tag_scheduler_uptime_days (Optional - str): The tag to be used to filter the EC2 instances to be used by the scheduler.
 
             ec2_tag_scheduler_skip (Optional - str): The tag to be used to filter the EC2 instances to be used by the scheduler.
+
+            will_drop_invalid_headers (Optional | str): Indicates whether HTTP headers with invalid header fields are removed by the load balancer ('true') or routed to targets ('false'). Default: false
     """
 
     def __init__(
@@ -105,6 +107,7 @@ class ECSCluster(Construct):
         ec2_tag_scheduler_uptime: Optional[str] = '08:00-18:00',
         ec2_tag_scheduler_uptime_days: Optional[str] = '1-2-3-4-5',
         ec2_tag_scheduler_skip: Optional[str] = 'False',
+        will_drop_invalid_headers: str = 'False',
     ) -> None:
         self.id = id
         self.scope = scope
@@ -145,6 +148,12 @@ class ECSCluster(Construct):
 
         self._create_cluster()
         if create_alb:
+            drop_invalid_headers = (
+                will_drop_invalid_headers
+                and isinstance(will_drop_invalid_headers, str)
+                and will_drop_invalid_headers.lower() == 'true'
+            )
+
             path = '_'.join(self.node.path.split('/')[:-1])[:28]
 
             self.alb = Alb(
@@ -162,6 +171,7 @@ class ECSCluster(Construct):
                 internet_facing=internet_facing,
                 use_cdn=use_cdn,
                 load_balancer_idle_timeout_in_seconds=load_balancer_idle_timeout,
+                will_drop_invalid_header_fields=drop_invalid_headers,
             )
         else:
             self.alb = None

aws_cdk_constructs-2.41.1/aws_cdk_constructs/lambdas/add-index/index.js

@@ -0,0 +1,2 @@
+(()=>{"use strict";var n={};({54979:function(n,e){var t=this&&this.__awaiter||function(n,e,t,i){return new(t||(t=Promise))(function(r,o){function u(n){try{a(i.next(n))}catch(n){o(n)}}function c(n){try{a(i.throw(n))}catch(n){o(n)}}function a(n){var e;n.done?r(n.value):(e=n.value,e instanceof t?e:new t(function(n){n(e)})).then(u,c)}a((i=i.apply(n,e||[])).next())})};Object.defineProperty(e,"__esModule",{value:!0}),e.handler=void 0,e.handler=n=>t(void 0,void 0,void 0,function*(){const e=n.Records[0].cf.request,t=e.uri;return t.endsWith("/")?e.uri+="index.html":t.includes(".")||(e.uri+="/index.html"),e})}})[54979].call(n,0,n),module.exports=n})();
+//# sourceMappingURL=index.js.map

aws_cdk_constructs-2.41.1/aws_cdk_constructs/lambdas/add-index/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-index/index.js","mappings":"uBAGIA,EAAsB,CAAC,G,mZCDd,EAAAC,QACFC,GAC4D,OAAD,4BAC9D,MAAMC,EAAUD,EAAME,QAAQ,GAAGC,GAAGF,QAC9BG,EAAMH,EAAQG,IAWpB,OARIA,EAAIC,SAAS,KACbJ,EAAQG,KAAO,aAGTA,EAAIE,SAAS,OACnBL,EAAQG,KAAO,eAGZH,CACX,E,IDdgB,OAAOM,KAAKT,EAAoB,EAAEA,G","sources":["webpack://aws-cdk-constructs/webpack/startup","webpack://aws-cdk-constructs/./lambda-src/add-index/index.ts"],"sourcesContent":["// startup\n// Load entry module and return exports\n// This entry module is referenced by other modules so it can't be inlined\nvar __webpack_exports__ = {};\n__webpack_modules__[54979].call(__webpack_exports__,0,__webpack_exports__);\n","import type { CloudFrontRequestEvent, CloudFrontResponseResult, CloudFrontRequestResult } from 'aws-lambda';\n\nexport const handler =\n    async (event: CloudFrontRequestEvent):\n        Promise<CloudFrontResponseResult | CloudFrontRequestResult> => {\n        const request = event.Records[0].cf.request;\n        const uri = request.uri;\n\n        // Check whether the URI is missing a file name.\n        if (uri.endsWith('/')) {\n            request.uri += 'index.html';\n        }\n        // Check whether the URI is missing a file extension.\n        else if (!uri.includes('.')) {\n            request.uri += '/index.html';\n        }\n\n        return request;\n    }"],"names":["__webpack_exports__","handler","event","request","Records","cf","uri","endsWith","includes","call"],"sourceRoot":""}