aws-cdk-constructs 2.45.0__tar.gz → 2.47.1__tar.gz

{aws_cdk_constructs-2.45.0/aws_cdk_constructs.egg-info → aws_cdk_constructs-2.47.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws_cdk_constructs
-Version: 2.45.0
+Version: 2.47.1
 Summary: AWS CDK constructs
 Home-page: https://bitbucket.org/cioapps/aws-cdk-constructs
 Author: author

{aws_cdk_constructs-2.45.0 → aws_cdk_constructs-2.47.1}/aws_cdk_constructs/__init__.py

@@ -15,4 +15,4 @@ from .load_balancer import Alb, Nlb
 from .security_group import SecurityGroup
 from .windows_server import WindowsServer
 
-__version__ = '2.45.0'
+__version__ = '2.47.1'

{aws_cdk_constructs-2.45.0 → aws_cdk_constructs-2.47.1}/aws_cdk_constructs/bucket/bucket.py

@@ -107,6 +107,8 @@ class Bucket(Construct):
         cdn_ssl_certificate_arn (str): If "will_implement_cdn" is "True" and you want to enable HTTPS for your CloudFront distribution, specify the SSL certificate ARN to use. NB: this certificate must be in North Virginia
 
         bucket_policy_statements: List[_iam.PolicyStatement]: List of policy statements to be added to the Bucket policy. Default: []
+
+        bucket_static_website_origin (str): Whether or not the S3 Bucket should be configured as Static Website Origin on CloudFront. It cannot be combined with bucket_has_authentication='True'. Default: false
     """
 
     @property
@@ -459,6 +461,7 @@ class Bucket(Construct):
             _cloudfront.ResponseHeadersPolicy, None
         ] = None,
         user_pool_client: Union[None, _cognito.UserPoolClient] = None,
+        bucket_static_website_origin: str = 'false',
         **kwargs,
     ) -> None:
         super().__init__(scope, id, **kwargs)
@@ -521,6 +524,23 @@ class Bucket(Construct):
             and will_implement_cdn.lower() == 'true'
         )
 
+        if (
+            bucket_static_website_origin
+            and bucket_static_website_origin.lower() == 'true'
+            and bucket_has_authentication
+            and bucket_has_authentication.lower() == 'true'
+        ):
+            raise ValueError(
+                'bucket_static_website_origin and bucket_has_authentication cannot both be enabled. '
+                'Static website origin requires public bucket access, which conflicts with authenticated access.'
+            )
+
+        static_website_origin = (
+            bucket_static_website_origin
+            and isinstance(bucket_static_website_origin, str)
+            and bucket_static_website_origin.lower() == 'true'
+        )
+
         # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ CloudFormation outputs
         if not omit_cloudformation_template_outputs:
             cdk.CfnOutput(
@@ -707,12 +727,20 @@ class Bucket(Construct):
                     allowed_headers=['*'],
                 )
 
+        # Define origin type
+        if static_website_origin:
+            origin = _cloudfront_origins.S3StaticWebsiteOrigin(self.bucket)
+        else:
+            origin = (
+                _cloudfront_origins.S3BucketOrigin.with_origin_access_control(
+                    self.bucket
+                )
+            )
+
         # Create CloudFront distribution
         if create_cdn:
             default_behavior = _cloudfront.BehaviorOptions(
-                origin=_cloudfront_origins.S3BucketOrigin.with_origin_access_control(
-                    self.bucket
-                ),
+                origin=origin,
                 compress=True,
                 # viewer_protocol_policy=_cloudfront.ViewerProtocolPolicy.HTTPS_ONLY,
                 allowed_methods=_cloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS,
@@ -805,10 +833,6 @@ class Bucket(Construct):
                 )
             )
 
-            origin = origins.S3BucketOrigin.with_origin_access_control(
-                self.bucket
-            )
-
             redirect_paths = RedirectPaths(
                 sign_in='/parseauth',
                 auth_refresh='/refreshauth',

{aws_cdk_constructs-2.45.0 → aws_cdk_constructs-2.47.1}/aws_cdk_constructs/ecs/cluster.py

@@ -80,6 +80,8 @@ class ECSCluster(Construct):
 
             ec2_tag_scheduler_skip (Optional - str): The tag to be used to filter the EC2 instances to be used by the scheduler.
 
+            ec2_send_emails (Optional - bool): When set to true, attaches the SMTP relay security group (defined by ``smtp_relay_security_group`` in the environment account parameters) to the EC2 launch template, allowing instances to send emails through the relay. Default is false.
+
             will_drop_invalid_headers (Optional | str): Indicates whether HTTP headers with invalid header fields are removed by the load balancer ('true') or routed to targets ('false'). Default: false
     """
 
@@ -101,6 +103,7 @@ class ECSCluster(Construct):
         ssl_certificate_arn: Optional[str] = None,
         load_balancer_idle_timeout: Optional[int] = None,
         ec2_enable: Optional[bool] = False,
+        ec2_send_emails: Optional[bool] = False,
         ec2_instance_type: Optional[str] = None,
         ec2_desired_capacity: Optional[int] = None,
         ec2_max_capacity: Optional[int] = None,
@@ -243,6 +246,18 @@ class ECSCluster(Construct):
                 security_group=self.ecs_sg,
                 instance_type=_ec2.InstanceType(ec2_instance_type),
             )
+
+            if ec2_send_emails:
+                sg = _ec2.SecurityGroup.from_security_group_id(
+                    scope=self,
+                    id=f'{app_name}-mail-sg',
+                    security_group_id=self.aws_account.get(
+                        'smtp_relay_security_group'
+                    ),
+                    mutable=False,
+                )
+                launch_template.add_security_group(sg)
+
             auto_scaling_group = _autoscaling.AutoScalingGroup(
                 self,
                 f'{app_name}-asg',

{aws_cdk_constructs-2.45.0 → aws_cdk_constructs-2.47.1/aws_cdk_constructs.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws_cdk_constructs
-Version: 2.45.0
+Version: 2.47.1
 Summary: AWS CDK constructs
 Home-page: https://bitbucket.org/cioapps/aws-cdk-constructs
 Author: author

{aws_cdk_constructs-2.45.0 → aws_cdk_constructs-2.47.1}/tests/test_bucket.py

@@ -725,6 +725,47 @@ def test_bucket_includes_cloudfront(app, stack, environment_parameters):
     )
 
 
+def test_bucket_static_website_origin(app, stack, environment_parameters):
+    cdn_domain = 'test.dev.fao.org'
+    cdn_ssl_certificate_arn = 'arn:aws:acm:us-east-1:test:certificate/test'
+    Bucket(
+        scope=stack,
+        id='test-bucket-id',
+        app_name='test-app',
+        environment='Development',
+        environments_parameters=environment_parameters,
+        bucket_name='test-bucket-name',
+        will_implement_cdn='True',
+        cdn_domain_names=[cdn_domain],
+        cdn_ssl_certificate_arn=cdn_ssl_certificate_arn,
+        bucket_static_website_origin='True',
+    )
+
+    template = Template.from_stack(stack)
+    template.has_resource_properties(
+        'AWS::CloudFront::Distribution',
+        {
+            'DistributionConfig': {
+                'Aliases': [cdn_domain],
+                'PriceClass': 'PriceClass_100',
+                'ViewerCertificate': {
+                    'AcmCertificateArn': cdn_ssl_certificate_arn,
+                    'MinimumProtocolVersion': 'TLSv1.2_2021',
+                    'SslSupportMethod': 'sni-only',
+                },
+                'Origins': [
+                    {
+                        'CustomOriginConfig': {
+                            'OriginProtocolPolicy': 'http-only',
+                            'OriginSSLProtocols': ['TLSv1.2'],
+                        },
+                    },
+                ],
+            },
+        },
+    )
+
+
 def test_bucket_with_object_ownership_when_no_public_read_access(
     app, stack, environment_parameters
 ):

{aws_cdk_constructs-2.45.0 → aws_cdk_constructs-2.47.1}/tests/test_ecs_cluster.py

@@ -667,6 +667,72 @@ def test_ecs_with_ec2_creates_right_launch_template(
     )
 
 
+def test_ecs_with_ec2_send_emails_attaches_smtp_security_group(
+    stack, vpc, hosted_zone, environment_parameters, mocker
+):
+    mocker.patch('aws_cdk.aws_ec2.Vpc.from_lookup', return_value=vpc)
+    mocker.patch(
+        'aws_cdk_constructs.ecs.cluster.ECSCluster._get_ami_id',
+        return_value='ami-123',
+    )
+
+    ECSCluster(
+        scope=stack,
+        id='x',
+        environment='development',
+        environments_parameters=environment_parameters,
+        app_name='testapp',
+        hosted_zone=hosted_zone,
+        ec2_enable=True,
+        ec2_instance_type='t2.micro',
+        ec2_max_capacity=1,
+        ec2_desired_capacity=1,
+        ec2_send_emails=True,
+    )
+    template = Template.from_stack(stack)
+    template.has_resource_properties(
+        'AWS::EC2::LaunchTemplate',
+        {
+            'LaunchTemplateData': {
+                'SecurityGroupIds': Match.array_with(['smtp-relay-sg-id'])
+            }
+        },
+    )
+
+
+def test_ecs_with_ec2_send_emails_false_does_not_attach_smtp_security_group(
+    stack, vpc, hosted_zone, environment_parameters, mocker
+):
+    mocker.patch('aws_cdk.aws_ec2.Vpc.from_lookup', return_value=vpc)
+    mocker.patch(
+        'aws_cdk_constructs.ecs.cluster.ECSCluster._get_ami_id',
+        return_value='ami-123',
+    )
+
+    ECSCluster(
+        scope=stack,
+        id='x',
+        environment='development',
+        environments_parameters=environment_parameters,
+        app_name='testapp',
+        hosted_zone=hosted_zone,
+        ec2_enable=True,
+        ec2_instance_type='t2.micro',
+        ec2_max_capacity=1,
+        ec2_desired_capacity=1,
+        ec2_send_emails=False,
+    )
+    template = Template.from_stack(stack)
+    launch_templates = template.find_resources('AWS::EC2::LaunchTemplate')
+    launch_template = list(launch_templates.values())[0]
+    security_group_ids = (
+        launch_template.get('Properties', {})
+        .get('LaunchTemplateData', {})
+        .get('SecurityGroupIds', [])
+    )
+    assert 'smtp-relay-sg-id' not in security_group_ids
+
+
 def test_ecs_with_ec2_creates_asg(
     stack, vpc, hosted_zone, environment_parameters, mocker
 ):