cdk-factory 0.17.4__tar.gz → 0.17.5__tar.gz

{cdk_factory-0.17.4 → cdk_factory-0.17.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cdk_factory
-Version: 0.17.4
+Version: 0.17.5
 Summary: CDK Factory. A QuickStarter and best practices setup for CDK projects
 Author-email: Eric Wilson <eric.wilson@geekcafe.com>
 License: MIT License

{cdk_factory-0.17.4 → cdk_factory-0.17.5}/pyproject.toml

@@ -33,7 +33,7 @@ markers = [
 [project]
 
 name = "cdk_factory"
-version = "0.17.4"
+version = "0.17.5"
 authors = [
   { name="Eric Wilson", email="eric.wilson@geekcafe.com" }
 ]

{cdk_factory-0.17.4 → cdk_factory-0.17.5}/src/cdk_factory/stack_library/vpc/vpc_stack_standardized.py

@@ -138,6 +138,7 @@ class VpcStack(IStack, StandardizedSsmMixin):
             "enable_dns_support": self.vpc_config.enable_dns_support,
             "max_azs": self.vpc_config.max_azs if not availability_zones else None,
             "availability_zones": availability_zones,  # Use explicit AZs when available
+            "restrict_default_security_group": self.vpc_config.get("restrict_default_security_group", False),
             "gateway_endpoints": (
                 {
                     "S3": ec2.GatewayVpcEndpointOptions(
@@ -152,6 +153,10 @@ class VpcStack(IStack, StandardizedSsmMixin):
         # Create the VPC
         vpc = ec2.Vpc(self, vpc_name, **vpc_props)
 
+        # Add IAM permissions for default security group restriction if enabled
+        if self.vpc_config.get("restrict_default_security_group", False):
+            self._add_default_sg_restriction_permissions(vpc)
+
         # Add interface endpoints if specified
         if self.vpc_config.enable_interface_endpoints:
             self._add_interface_endpoints(vpc, self.vpc_config.interface_endpoints)
@@ -392,6 +397,31 @@ class VpcStack(IStack, StandardizedSsmMixin):
         
         logger.info(f"Exported SSM parameters: {exported_params}")
 
+    def _add_default_sg_restriction_permissions(self, vpc: ec2.Vpc) -> None:
+        """
+        Add IAM permissions required for default security group restriction.
+        
+        CDK creates a custom resource that needs ec2:AuthorizeSecurityGroupIngress
+        permission to restrict the default security group.
+        """
+        from aws_cdk import aws_iam as iam
+        
+        # Find the custom resource role that CDK creates for default SG restriction
+        # The role follows a naming pattern: {VpcName}-CustomVpcRestrictDefaultSGCustomResource*
+        
+        # Grant the required permissions to all roles in this stack that might need it
+        # This is a broad approach since we can't easily predict the exact role name
+        for child in self.node.children:
+            if hasattr(child, 'role') and hasattr(child.role, 'add_to_policy'):
+                child.role.add_to_policy(iam.PolicyStatement(
+                    actions=[
+                        "ec2:AuthorizeSecurityGroupIngress",
+                        "ec2:RevokeSecurityGroupIngress", 
+                        "ec2:UpdateSecurityGroupRuleDescriptionsIngress"
+                    ],
+                    resources=[vpc.vpc_default_security_group.security_group_arn]
+                ))
+
     # Backward compatibility methods
     def auto_export_resources(self, resource_values: Dict[str, Any], context: Dict[str, Any] = None) -> Dict[str, str]:
         """Backward compatibility method for existing modules."""

cdk_factory-0.17.5/src/cdk_factory/version.py

@@ -0,0 +1 @@
+__version__ = "0.17.5"

cdk_factory-0.17.4/src/cdk_factory/version.py

@@ -1 +0,0 @@
-__version__ = "0.17.4"