cdk-factory 0.17.3__tar.gz → 0.17.5__tar.gz

{cdk_factory-0.17.3 → cdk_factory-0.17.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cdk_factory
-Version: 0.17.3
+Version: 0.17.5
 Summary: CDK Factory. A QuickStarter and best practices setup for CDK projects
 Author-email: Eric Wilson <eric.wilson@geekcafe.com>
 License: MIT License

{cdk_factory-0.17.3 → cdk_factory-0.17.5}/pyproject.toml

@@ -33,7 +33,7 @@ markers = [
 [project]
 
 name = "cdk_factory"
-version = "0.17.3"
+version = "0.17.5"
 authors = [
   { name="Eric Wilson", email="eric.wilson@geekcafe.com" }
 ]

{cdk_factory-0.17.3 → cdk_factory-0.17.5}/src/cdk_factory/interfaces/vpc_provider_mixin.py

@@ -136,13 +136,10 @@ class VPCProviderMixin:
             "availability_zones": availability_zones,
         }
         
-        # If we have subnet_ids from SSM, use the actual subnet IDs
+        # If we have subnet_ids from SSM, add them to the attributes
         if subnet_ids:
             # Use the actual subnet IDs from SSM
             vpc_attrs["public_subnet_ids"] = subnet_ids
-        else:
-            # Fallback to dummy subnets if no valid subnet IDs
-            vpc_attrs["public_subnet_ids"] = ["subnet-dummy1", "subnet-dummy2"]
         
         # Use from_vpc_attributes() for SSM tokens with unique construct name
         self._vpc = ec2.Vpc.from_vpc_attributes(self, f"{self.stack_name}-VPC", **vpc_attrs)

{cdk_factory-0.17.3 → cdk_factory-0.17.5}/src/cdk_factory/stack_library/vpc/vpc_stack_standardized.py

@@ -111,6 +111,23 @@ class VpcStack(IStack, StandardizedSsmMixin):
         # Configure NAT gateways
         nat_gateway_count = self.vpc_config.nat_gateways.get("count", 1)
 
+        # Get explicit availability zones to avoid dummy AZs in pipeline synthesis
+        # When CDK synthesizes in a pipeline context, it doesn't have access to real AZs
+        # So we explicitly specify them based on the deployment region
+        availability_zones = None
+        if self.deployment:
+            region = self.deployment.region or "us-east-1"
+            # Explicitly list AZs for the region to avoid dummy values
+            max_azs = self.vpc_config.max_azs or 2
+            if region == "us-east-1":
+                availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"][:max_azs]
+            elif region == "us-east-2":
+                availability_zones = ["us-east-2a", "us-east-2b", "us-east-2c"][:max_azs]
+            elif region == "us-west-1":
+                availability_zones = ["us-west-1a", "us-west-1c"][:max_azs]
+            elif region == "us-west-2":
+                availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"][:max_azs]
+
         # Build VPC properties
         vpc_props = {
             "vpc_name": vpc_name,
@@ -119,7 +136,9 @@ class VpcStack(IStack, StandardizedSsmMixin):
             "subnet_configuration": subnet_configuration,
             "enable_dns_hostnames": self.vpc_config.enable_dns_hostnames,
             "enable_dns_support": self.vpc_config.enable_dns_support,
-            "max_azs": self.vpc_config.max_azs,  # Use max_azs instead of explicit availability_zones
+            "max_azs": self.vpc_config.max_azs if not availability_zones else None,
+            "availability_zones": availability_zones,  # Use explicit AZs when available
+            "restrict_default_security_group": self.vpc_config.get("restrict_default_security_group", False),
             "gateway_endpoints": (
                 {
                     "S3": ec2.GatewayVpcEndpointOptions(
@@ -134,6 +153,10 @@ class VpcStack(IStack, StandardizedSsmMixin):
         # Create the VPC
         vpc = ec2.Vpc(self, vpc_name, **vpc_props)
 
+        # Add IAM permissions for default security group restriction if enabled
+        if self.vpc_config.get("restrict_default_security_group", False):
+            self._add_default_sg_restriction_permissions(vpc)
+
         # Add interface endpoints if specified
         if self.vpc_config.enable_interface_endpoints:
             self._add_interface_endpoints(vpc, self.vpc_config.interface_endpoints)
@@ -374,6 +397,31 @@ class VpcStack(IStack, StandardizedSsmMixin):
         
         logger.info(f"Exported SSM parameters: {exported_params}")
 
+    def _add_default_sg_restriction_permissions(self, vpc: ec2.Vpc) -> None:
+        """
+        Add IAM permissions required for default security group restriction.
+        
+        CDK creates a custom resource that needs ec2:AuthorizeSecurityGroupIngress
+        permission to restrict the default security group.
+        """
+        from aws_cdk import aws_iam as iam
+        
+        # Find the custom resource role that CDK creates for default SG restriction
+        # The role follows a naming pattern: {VpcName}-CustomVpcRestrictDefaultSGCustomResource*
+        
+        # Grant the required permissions to all roles in this stack that might need it
+        # This is a broad approach since we can't easily predict the exact role name
+        for child in self.node.children:
+            if hasattr(child, 'role') and hasattr(child.role, 'add_to_policy'):
+                child.role.add_to_policy(iam.PolicyStatement(
+                    actions=[
+                        "ec2:AuthorizeSecurityGroupIngress",
+                        "ec2:RevokeSecurityGroupIngress", 
+                        "ec2:UpdateSecurityGroupRuleDescriptionsIngress"
+                    ],
+                    resources=[vpc.vpc_default_security_group.security_group_arn]
+                ))
+
     # Backward compatibility methods
     def auto_export_resources(self, resource_values: Dict[str, Any], context: Dict[str, Any] = None) -> Dict[str, str]:
         """Backward compatibility method for existing modules."""

cdk_factory-0.17.5/src/cdk_factory/version.py

@@ -0,0 +1 @@
+__version__ = "0.17.5"

cdk_factory-0.17.3/src/cdk_factory/version.py

@@ -1 +0,0 @@
-__version__ = "0.17.3"