cdk-factory 0.17.3__py3-none-any.whl → 0.17.5__py3-none-any.whl

cdk_factory/interfaces/vpc_provider_mixin.py

@@ -136,13 +136,10 @@ class VPCProviderMixin:
             "availability_zones": availability_zones,
         }
         
-        # If we have subnet_ids from SSM, use the actual subnet IDs
+        # If we have subnet_ids from SSM, add them to the attributes
         if subnet_ids:
             # Use the actual subnet IDs from SSM
             vpc_attrs["public_subnet_ids"] = subnet_ids
-        else:
-            # Fallback to dummy subnets if no valid subnet IDs
-            vpc_attrs["public_subnet_ids"] = ["subnet-dummy1", "subnet-dummy2"]
         
         # Use from_vpc_attributes() for SSM tokens with unique construct name
         self._vpc = ec2.Vpc.from_vpc_attributes(self, f"{self.stack_name}-VPC", **vpc_attrs)

cdk_factory/stack_library/vpc/vpc_stack_standardized.py

@@ -111,6 +111,23 @@ class VpcStack(IStack, StandardizedSsmMixin):
         # Configure NAT gateways
         nat_gateway_count = self.vpc_config.nat_gateways.get("count", 1)
 
+        # Get explicit availability zones to avoid dummy AZs in pipeline synthesis
+        # When CDK synthesizes in a pipeline context, it doesn't have access to real AZs
+        # So we explicitly specify them based on the deployment region
+        availability_zones = None
+        if self.deployment:
+            region = self.deployment.region or "us-east-1"
+            # Explicitly list AZs for the region to avoid dummy values
+            max_azs = self.vpc_config.max_azs or 2
+            if region == "us-east-1":
+                availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"][:max_azs]
+            elif region == "us-east-2":
+                availability_zones = ["us-east-2a", "us-east-2b", "us-east-2c"][:max_azs]
+            elif region == "us-west-1":
+                availability_zones = ["us-west-1a", "us-west-1c"][:max_azs]
+            elif region == "us-west-2":
+                availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"][:max_azs]
+
         # Build VPC properties
         vpc_props = {
             "vpc_name": vpc_name,
@@ -119,7 +136,9 @@ class VpcStack(IStack, StandardizedSsmMixin):
             "subnet_configuration": subnet_configuration,
             "enable_dns_hostnames": self.vpc_config.enable_dns_hostnames,
             "enable_dns_support": self.vpc_config.enable_dns_support,
-            "max_azs": self.vpc_config.max_azs,  # Use max_azs instead of explicit availability_zones
+            "max_azs": self.vpc_config.max_azs if not availability_zones else None,
+            "availability_zones": availability_zones,  # Use explicit AZs when available
+            "restrict_default_security_group": self.vpc_config.get("restrict_default_security_group", False),
             "gateway_endpoints": (
                 {
                     "S3": ec2.GatewayVpcEndpointOptions(
@@ -134,6 +153,10 @@ class VpcStack(IStack, StandardizedSsmMixin):
         # Create the VPC
         vpc = ec2.Vpc(self, vpc_name, **vpc_props)
 
+        # Add IAM permissions for default security group restriction if enabled
+        if self.vpc_config.get("restrict_default_security_group", False):
+            self._add_default_sg_restriction_permissions(vpc)
+
         # Add interface endpoints if specified
         if self.vpc_config.enable_interface_endpoints:
             self._add_interface_endpoints(vpc, self.vpc_config.interface_endpoints)
@@ -374,6 +397,31 @@ class VpcStack(IStack, StandardizedSsmMixin):
         
         logger.info(f"Exported SSM parameters: {exported_params}")
 
+    def _add_default_sg_restriction_permissions(self, vpc: ec2.Vpc) -> None:
+        """
+        Add IAM permissions required for default security group restriction.
+        
+        CDK creates a custom resource that needs ec2:AuthorizeSecurityGroupIngress
+        permission to restrict the default security group.
+        """
+        from aws_cdk import aws_iam as iam
+        
+        # Find the custom resource role that CDK creates for default SG restriction
+        # The role follows a naming pattern: {VpcName}-CustomVpcRestrictDefaultSGCustomResource*
+        
+        # Grant the required permissions to all roles in this stack that might need it
+        # This is a broad approach since we can't easily predict the exact role name
+        for child in self.node.children:
+            if hasattr(child, 'role') and hasattr(child.role, 'add_to_policy'):
+                child.role.add_to_policy(iam.PolicyStatement(
+                    actions=[
+                        "ec2:AuthorizeSecurityGroupIngress",
+                        "ec2:RevokeSecurityGroupIngress", 
+                        "ec2:UpdateSecurityGroupRuleDescriptionsIngress"
+                    ],
+                    resources=[vpc.vpc_default_security_group.security_group_arn]
+                ))
+
     # Backward compatibility methods
     def auto_export_resources(self, resource_values: Dict[str, Any], context: Dict[str, Any] = None) -> Dict[str, str]:
         """Backward compatibility method for existing modules."""

cdk_factory/version.py

@@ -1 +1 @@
-__version__ = "0.17.3"
+__version__ = "0.17.5"

{cdk_factory-0.17.3.dist-info → cdk_factory-0.17.5.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cdk_factory
-Version: 0.17.3
+Version: 0.17.5
 Summary: CDK Factory. A QuickStarter and best practices setup for CDK projects
 Author-email: Eric Wilson <eric.wilson@geekcafe.com>
 License: MIT License

{cdk_factory-0.17.3.dist-info → cdk_factory-0.17.5.dist-info}/RECORD

@@ -2,7 +2,7 @@ cdk_factory/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cdk_factory/app.py,sha256=RnX0-pwdTAPAdKJK_j13Zl8anf9zYKBwboR0KA8K8xM,10346
 cdk_factory/cdk.json,sha256=SKZKhJ2PBpFH78j-F8S3VDYW-lf76--Q2I3ON-ZIQfw,3106
 cdk_factory/cli.py,sha256=FGbCTS5dYCNsfp-etshzvFlGDCjC28r6rtzYbe7KoHI,6407
-cdk_factory/version.py,sha256=EeS9PekXNgzjvO0Cb50iNEGmbKhvoH8cFB_Sc6cUoRU,23
+cdk_factory/version.py,sha256=ZIYpuZI41Jfj-0NfW9-SGHVIJ9A014nURtKnLa84glc,23
 cdk_factory/builds/README.md,sha256=9BBWd7bXpyKdMU_g2UljhQwrC9i5O_Tvkb6oPvndoZk,90
 cdk_factory/commands/command_loader.py,sha256=QbLquuP_AdxtlxlDy-2IWCQ6D-7qa58aphnDPtp_uTs,3744
 cdk_factory/configurations/base_config.py,sha256=eJ3Pl3GWk1jVr_bYQaaWlw4_-ZiFGaiXllI_fOOX1i0,9323
@@ -67,7 +67,7 @@ cdk_factory/interfaces/istack.py,sha256=3xqGw5kNTt_KeLHdMxI7rIR0YORqcWQOqsacmDlT
 cdk_factory/interfaces/live_ssm_resolver.py,sha256=3FIr9a02SXqZmbFs3RT0WxczWEQR_CF7QSt7kWbDrVE,8163
 cdk_factory/interfaces/networked_stack_mixin.py,sha256=69pJp4IE1n_tdHh2UZQ08O6ZW-v5P4uJJ_fleNaj6Nw,2897
 cdk_factory/interfaces/standardized_ssm_mixin.py,sha256=-BT-K7mro2f3taS7biAm_oaxC7z2lurUfNUpryvahXk,22680
-cdk_factory/interfaces/vpc_provider_mixin.py,sha256=tfe3XqWd4lf5mMHGKexDcWmS0T2CKHSP0TDDyp6MPoY,8363
+cdk_factory/interfaces/vpc_provider_mixin.py,sha256=Kj0mmZd54NINprixJLs8zL-WWiSd0AQBtGdwNg8cz14,8207
 cdk_factory/lambdas/health_handler.py,sha256=dd40ykKMxWCFEIyp2ZdQvAGNjw_ylI9CSm1N24Hp2ME,196
 cdk_factory/lambdas/edge/ip_gate/handler.py,sha256=gUevgX462mqGYddtQIyJ1-Jk3oXhFmbmd46jlqjai9E,10657
 cdk_factory/pipeline/path_utils.py,sha256=fvWdrcb4onmpIu1APkHLhXg8zWfK74HcW3Ra2ynxfXM,2586
@@ -117,7 +117,7 @@ cdk_factory/stack_library/security_group/security_group_full_stack.py,sha256=yvZ
 cdk_factory/stack_library/security_group/security_group_stack.py,sha256=Zv9FCEHvSBT1cM9bXOtyIUFwhRHKCSTgvaqOyhGj0wg,14456
 cdk_factory/stack_library/simple_queue_service/sqs_stack.py,sha256=jJksWrvrvgZUMM01RZ317DOIxqIJbkYYSYu38w0jHpc,6039
 cdk_factory/stack_library/vpc/__init__.py,sha256=7pIqP97Gf2AJbv9Ebp1WbQGHYhgEbWJ52L1MzeXBybA,42
-cdk_factory/stack_library/vpc/vpc_stack_standardized.py,sha256=DiyrbRL_cBfkl4WMQsxuIpLYshHh7NSKWyoqiD300y8,16473
+cdk_factory/stack_library/vpc/vpc_stack_standardized.py,sha256=7vd_n6L7VYusIdnXREicJ2HUlxWbk3cOgzffH5nD1Mw,19136
 cdk_factory/stack_library/websites/static_website_stack.py,sha256=A292BlKDof0JnVewkK_3JiRB04rX7J9Na0a-iz3JWzw,11243
 cdk_factory/stages/websites/static_website_stage.py,sha256=X4fpKXkhb0zIbSHx3QyddBhVSLBryb1vf1Cg2fMTqog,755
 cdk_factory/templates/README.md,sha256=ATBEjG6beYvbEAdLtZ_8xnxgFD5X0cgZoI_6pToqH90,2679
@@ -136,8 +136,8 @@ cdk_factory/utilities/os_execute.py,sha256=5Op0LY_8Y-pUm04y1k8MTpNrmQvcLmQHPQITE
 cdk_factory/utils/api_gateway_utilities.py,sha256=If7Xu5s_UxmuV-kL3JkXxPLBdSVUKoLtohm0IUFoiV8,4378
 cdk_factory/validation/config_validator.py,sha256=Pb0TkLiPFzUplBOgMorhRCVm08vEzZhRU5xXCDTa5CA,17602
 cdk_factory/workload/workload_factory.py,sha256=yDI3cRhVI5ELNDcJPLpk9UY54Uind1xQoV3spzT4z7E,6068
-cdk_factory-0.17.3.dist-info/METADATA,sha256=OvYCQwGtZ3Jev3-MEOQJjTRtO-n-R_VbV-Q_oE1aVcc,2451
-cdk_factory-0.17.3.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-cdk_factory-0.17.3.dist-info/entry_points.txt,sha256=S1DPe0ORcdiwEALMN_WIo3UQrW_g4YdQCLEsc_b0Swg,53
-cdk_factory-0.17.3.dist-info/licenses/LICENSE,sha256=NOtdOeLwg2il_XBJdXUPFPX8JlV4dqTdDGAd2-khxT8,1066
-cdk_factory-0.17.3.dist-info/RECORD,,
+cdk_factory-0.17.5.dist-info/METADATA,sha256=R2L5fuA3X_oTcd-wwZoLOk0tpzAf-jkmoEAdiANmf_I,2451
+cdk_factory-0.17.5.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+cdk_factory-0.17.5.dist-info/entry_points.txt,sha256=S1DPe0ORcdiwEALMN_WIo3UQrW_g4YdQCLEsc_b0Swg,53
+cdk_factory-0.17.5.dist-info/licenses/LICENSE,sha256=NOtdOeLwg2il_XBJdXUPFPX8JlV4dqTdDGAd2-khxT8,1066
+cdk_factory-0.17.5.dist-info/RECORD,,