cdk-factory 0.19.13__py3-none-any.whl → 0.20.5__py3-none-any.whl

cdk_factory/stack_library/lambda_edge/functions/log_retention_manager/edge_log_retention.py

@@ -0,0 +1,85 @@
+#!/usr/bin/env python3
+import boto3
+from botocore.exceptions import ClientError
+import os
+
+profile_name = os.getenv('AWS_PROFILE')
+session = boto3.Session(region_name='us-east-1', profile_name=profile_name)
+ec2 = session.client('ec2')
+
+def set_edge_log_retention(retention_days=7, dry_run=True):
+    """
+    Find Lambda@Edge log groups across all regions and set retention policies.
+    
+    Args:
+        retention_days (int): Number of days to retain logs
+        dry_run (bool): If True, only show what would be changed
+    """
+    # Get all AWS regions
+    regions = [region['RegionName'] for region in ec2.describe_regions()['Regions']]
+    
+    edge_log_groups = []
+    total_changed = 0
+    
+    print(f"🔍 Hunting for Lambda@Edge log groups across {len(regions)} regions...")
+    print(f"🎯 Target retention: {retention_days} days")
+    print(f"🧪 Dry run: {dry_run}")
+    print("=" * 60)
+    
+    for region in regions:
+        try:
+            logs = session.client('logs', region_name=region)
+            
+            # Find log groups with us-east-1 prefix (indicating Edge functions)
+            paginator = logs.get_paginator('describe_log_groups')
+            for page in paginator.paginate():
+                for log_group in page.get('logGroups', []):
+                    log_group_name = log_group['logGroupName']
+                    
+                    # Check if it's a Lambda@Edge log group
+                    if '/aws/lambda/us-east-1.' in log_group_name:
+                        current_retention = log_group.get('retentionInDays')
+                        
+                        edge_log_groups.append({
+                            'region': region,
+                            'name': log_group_name,
+                            'current_retention': current_retention,
+                            'stored_bytes': log_group.get('storedBytes', 0)
+                        })
+                        
+                        # Set retention if needed
+                        if current_retention != retention_days:
+                            if dry_run:
+                                print(f"📍 {region}: Would set {log_group_name} to {retention_days} days (current: {current_retention})")
+                            else:
+                                try:
+                                    logs.put_retention_policy(
+                                        logGroupName=log_group_name,
+                                        retentionInDays=retention_days
+                                    )
+                                    print(f"✅ {region}: Set {log_group_name} to {retention_days} days")
+                                    total_changed += 1
+                                except ClientError as e:
+                                    print(f"❌ {region}: Failed to set {log_group_name} - {e}")
+                        else:
+                            print(f"✓ {region}: {log_group_name} already has {retention_days} days retention")
+                            
+        except ClientError as e:
+            # Skip regions where CloudWatch Logs isn't available
+            continue
+    
+    print("=" * 60)
+    print(f"📊 Summary:")
+    print(f"   Found {len(edge_log_groups)} Lambda@Edge log groups")
+    print(f"   Total storage: {sum(g['stored_bytes'] for g in edge_log_groups) / (1024**3):.2f} GB")
+    if not dry_run:
+        print(f"   Changed {total_changed} log groups")
+    
+    return edge_log_groups
+
+if __name__ == "__main__":
+    # Dry run first to see what would be changed
+    edge_logs = set_edge_log_retention(retention_days=7, dry_run=True)
+    
+    # Uncomment the line below to actually make changes
+    # set_edge_log_retention(retention_days=7, dry_run=False)

cdk_factory/stack_library/lambda_edge/functions/log_retention_manager/requirements.txt

@@ -0,0 +1,2 @@
+# aws-lambda-powertools
+aws-lambda-powertools

cdk_factory/stack_library/lambda_edge/functions/log_retention_manager/test.py

@@ -0,0 +1,22 @@
+from app import lambda_handler
+
+if __name__ == "__main__":
+
+    event = {
+        "version": "0",
+        "id": "12345678-1234-1234-1234-123456789012",
+        "detail-type": "Scheduled Event",
+        "source": "aws.events",
+        "account": "123456789012",
+        "time": "2024-01-15T10:00:00Z",
+        "region": "us-east-1",
+        "resources": [
+            "arn:aws:events:us-east-1:123456789012:rule/LogRetentionManager"
+        ],
+        "detail": {
+            "days": 7,
+            "dry_run": False
+        }
+    }
+    
+    lambda_handler(event, None)

cdk_factory/stack_library/lambda_edge/lambda_edge_stack.py

@@ -134,7 +134,12 @@ class LambdaEdgeStack(IStack, StandardizedSsmMixin):
         
         resolved_env = {}
         
-        for key, value in self.edge_config.environment.items():
+        # Use the new simplified configuration structure
+        configuration = self.edge_config.dictionary.get("configuration", {})
+        runtime_config = configuration.get("runtime", {})
+        ui_config = configuration.get("ui", {})
+        
+        for key, value in runtime_config.items():
             # Check if value is an SSM parameter reference
             if isinstance(value, str) and value.startswith("{{ssm:") and value.endswith("}}"):
                 # Extract SSM parameter path
@@ -216,11 +221,23 @@ class LambdaEdgeStack(IStack, StandardizedSsmMixin):
         # Since Lambda@Edge doesn't support environment variables, we bundle a config file
         # Use the full function_name (e.g., "tech-talk-dev-ip-gate") not just the base name
         resolved_env = self._resolve_environment_variables()
+        
+        # Get the UI configuration
+        configuration = self.edge_config.dictionary.get("configuration", {})
+        ui_config = configuration.get("ui", {})
+        
+
+        workload_name = self.deployment.workload.get("name")
+
+        if not workload_name:
+            raise ValueError("Workload name is required for Lambda@Edge function")
         runtime_config = {
             'environment': self.deployment.environment,
+            'workload': workload_name,
             'function_name': function_name,
             'region': self.deployment.region,
-            'environment_variables': resolved_env  # Add actual environment variables
+            'runtime': resolved_env,  # Runtime variables (SSM, etc.)
+            'ui': ui_config  # UI configuration (colors, messages, etc.)
         }
         
         runtime_config_path = temp_code_dir / 'runtime_config.json'
@@ -248,21 +265,17 @@ class LambdaEdgeStack(IStack, StandardizedSsmMixin):
             self.edge_config.runtime,
             _lambda.Runtime.PYTHON_3_11
         )
-        
-        # Lambda@Edge does NOT support environment variables
-        # Configuration must be handled via:
-        # 1. Hardcoded in the function code
-        # 2. Fetched from SSM Parameter Store at runtime
-        # 3. Other configuration mechanisms
-        
+
         # Log warning if environment variables are configured
-        if self.edge_config.environment:
+        configuration = self.edge_config.dictionary.get("configuration", {})
+        runtime_config = configuration.get("runtime", {})
+        
+        if runtime_config:
             logger.warning(
                 f"Lambda@Edge function '{function_name}' has environment variables configured, "
-                "but Lambda@Edge does not support environment variables. "
-                "The function must fetch these values from SSM Parameter Store at runtime."
+                "but Lambda@Edge does not support environment variables. The function must fetch these values from SSM Parameter Store at runtime."
             )
-            for key, value in self.edge_config.environment.items():
+            for key, value in runtime_config.items():
                 logger.warning(f"  - {key}: {value}")
         
         # Create execution role with CloudWatch Logs and SSM permissions
@@ -283,7 +296,7 @@ class LambdaEdgeStack(IStack, StandardizedSsmMixin):
         )
         
         # Add SSM read permissions if environment variables reference SSM parameters
-        if self.edge_config.environment:
+        if runtime_config:
             execution_role.add_to_policy(
                 iam.PolicyStatement(
                     effect=iam.Effect.ALLOW,
@@ -293,12 +306,88 @@ class LambdaEdgeStack(IStack, StandardizedSsmMixin):
                         "ssm:GetParametersByPath"
                     ],
                     resources=[
-                        f"arn:aws:ssm:*:{cdk.Aws.ACCOUNT_ID}:parameter/*"
+                        f"arn:aws:ssm:*:{self.deployment.account}:parameter/*"
                     ]
                 )
             )
         
-        # Create the Lambda function WITHOUT environment variables
+        # Add Secrets Manager permissions for origin secret access
+        execution_role.add_to_policy(
+            iam.PolicyStatement(
+                effect=iam.Effect.ALLOW,
+                actions=[
+                    "secretsmanager:GetSecretValue",
+                    "secretsmanager:DescribeSecret"
+                ],
+                resources=[
+                    f"arn:aws:secretsmanager:*:{self.deployment.account}:secret:{self.deployment.environment}/{self.workload.name}/origin-secret*"
+                ]
+            )
+        )
+        
+        # Add ELB permissions for target health API access
+        execution_role.add_to_policy(
+            iam.PolicyStatement(
+                effect=iam.Effect.ALLOW,
+                actions=[
+                    "elasticloadbalancing:DescribeTargetHealth",
+                    "elasticloadbalancing:DescribeTargetGroups",
+                    "elasticloadbalancing:DescribeLoadBalancers",
+                    "elasticloadbalancing:DescribeListeners",
+                    "elasticloadbalancing:DescribeTags"
+                ],
+                resources=[
+                    "*"
+                ]
+            )
+        )
+        
+        # Add ACM permissions for certificate validation
+        execution_role.add_to_policy(
+            iam.PolicyStatement(
+                effect=iam.Effect.ALLOW,
+                actions=[
+                    "acm:DescribeCertificate",
+                    "acm:ListCertificates"
+                ],
+                resources=[
+                    f"arn:aws:acm:*:{self.deployment.account}:certificate/*"
+                ]
+            )
+        )
+        
+        # Add Route 53 permissions for health check access
+        execution_role.add_to_policy(
+            iam.PolicyStatement(
+                effect=iam.Effect.ALLOW,
+                actions=[
+                    "route53:GetHealthCheckStatus",
+                    "route53:ListHealthChecks",
+                    "route53:GetHealthCheck"
+                ],
+                resources=[
+                    f"arn:aws:route53:::{self.deployment.account}:health-check/*"
+                ]
+            )
+        )
+        
+        # Add CloudWatch permissions for enhanced logging and metrics
+        execution_role.add_to_policy(
+            iam.PolicyStatement(
+                effect=iam.Effect.ALLOW,
+                actions=[
+                    "logs:CreateLogGroup",
+                    "logs:CreateLogStream",
+                    "logs:PutLogEvents",
+                    "cloudwatch:PutMetricData"
+                ],
+                resources=[
+                    f"arn:aws:logs:*:{self.deployment.account}:log-group:/aws/lambda/*",
+                    f"arn:aws:cloudwatch:*:{self.deployment.account}:metric:*"
+                ]
+            )
+        )
+    
         self.function = _lambda.Function(
             self,
             function_name,
@@ -311,6 +400,7 @@ class LambdaEdgeStack(IStack, StandardizedSsmMixin):
             description=self.edge_config.description,
             role=execution_role,
             # Lambda@Edge does NOT support environment variables
+            # Configuration must be fetched from SSM at runtime
             log_retention=logs.RetentionDays.ONE_WEEK,
         )
         
@@ -365,60 +455,45 @@ class LambdaEdgeStack(IStack, StandardizedSsmMixin):
 
     def _configure_edge_log_retention(self, function_name: str) -> None:
         """
-        Configure log retention for Lambda@Edge regional logs.
+        Configure log retention for Lambda@Edge log groups in all edge regions
         
-        Lambda@Edge creates log groups in multiple regions that need
-        separate retention configuration from the primary log group.
+        TODO: IMPLEMENT POST-DEPLOYMENT SOLUTION
+        --------------------------------------
+        Lambda@Edge log groups are created on-demand when the function is invoked
+        at edge locations, not during deployment. This means we cannot set retention
+        policies during CloudFormation deployment.
+        
+        Possible solutions to implement:
+        1. EventBridge rule that triggers on log group creation
+        2. Custom Lambda function that runs periodically to set retention
+        3. Post-deployment script that waits for log groups to appear
+        4. CloudWatch Logs subscription filter that handles new log groups
+        
+        Current behavior: DISABLED to prevent deployment failures
         """
-        from aws_cdk import custom_resources as cr
         
-        # Get edge log retention from config (default to same as primary logs)
+        # DISABLED: Edge log groups don't exist during deployment
+        # Lambda@Edge creates log groups on-demand at edge locations
+        # Setting retention policies during deployment fails with "log group does not exist"
+        
         edge_retention_days = self.edge_config.dictionary.get("edge_log_retention_days", 7)
+        logger.warning(
+            f"Edge log retention configuration disabled - log groups are created on-demand. "
+            f"Desired retention: {edge_retention_days} days. "
+            f"See TODO in _configure_edge_log_retention() for implementation approach."
+        )
         
-        # List of common Lambda@Edge regions
-        edge_regions = [
-            'us-east-1', 'us-east-2', 'us-west-1', 'us-west-2',
-            'eu-west-1', 'eu-west-2', 'eu-central-1',
-            'ap-southeast-1', 'ap-southeast-2', 'ap-northeast-1',
-            'ca-central-1', 'sa-east-1'
-        ]
-        
-        # Create custom resource to set log retention for each region
-        for region in edge_regions:
-            log_group_name = f"/aws/lambda/{region}.{function_name}"
-            
-            # Use AwsCustomResource to set log retention
-            cr.AwsCustomResource(
-                self, f"EdgeLogRetention-{region}",
-                on_update={
-                    "service": "Logs",
-                    "action": "putRetentionPolicy",
-                    "parameters": {
-                        "logGroupName": log_group_name,
-                        "retentionInDays": edge_retention_days
-                    },
-                    "physical_resource_id": cr.PhysicalResourceId.from_response("logGroupName")
-                },
-                on_delete={
-                    "service": "Logs", 
-                    "action": "deleteRetentionPolicy",
-                    "parameters": {
-                        "logGroupName": log_group_name
-                    },
-                    "physical_resource_id": cr.PhysicalResourceId.from_response("logGroupName")
-                },
-                policy=cr.AwsCustomResourcePolicy.from_sdk_calls(
-                    resources=[f"arn:aws:logs:{region}:*:log-group:{log_group_name}*"]
-                )
-            )
+        # TODO: Implement one of these solutions:
+        # 1. EventBridge + Lambda: Trigger on log group creation and set retention
+        # 2. Periodic Lambda: Scan for edge log groups and apply retention policies  
+        # 3. Post-deployment script: Wait for log groups to appear after edge replication
+        # 4. CloudWatch Logs subscription: Process new log group events
         
-        logger.info(f"Configured edge log retention to {edge_retention_days} days for {len(edge_regions)} regions")
+        return
 
     def _add_outputs(self, function_name: str) -> None:
         """Add CloudFormation outputs and SSM exports"""
         
-        
-        
         # SSM Parameter Store exports (if configured)
         ssm_exports = self.edge_config.dictionary.get("ssm", {}).get("exports", {})
         if ssm_exports:
@@ -440,40 +515,34 @@ class LambdaEdgeStack(IStack, StandardizedSsmMixin):
                         description=f"{key} for Lambda@Edge function {function_name}"
                     )
         
-        # Export environment variables as SSM parameters
-        # Since Lambda@Edge doesn't support environment variables, we export them
-        # to SSM so the Lambda function can fetch them at runtime
-        if self.edge_config.environment:
-            logger.info("Exporting Lambda@Edge environment variables as SSM parameters")
-            env_ssm_exports = self.edge_config.dictionary.get("environment_ssm_exports", {})
-            
-            # If no explicit environment_ssm_exports, create default SSM paths
-            if not env_ssm_exports:
-                # Auto-generate SSM parameter names based on environment variable names
-                for env_key in self.edge_config.environment.keys():
-                    # Use snake_case version of the key for SSM path
-                    ssm_key = env_key.lower().replace('_', '-')
-                    env_ssm_exports[env_key] = f"/{self.deployment.environment}/{function_name}/{ssm_key}"
-            
-            # Resolve and export environment variables to SSM
-            resolved_env = self._resolve_environment_variables()
-            for env_key, ssm_path in env_ssm_exports.items():
-                if env_key in resolved_env:
-                    env_value = resolved_env[env_key]
-                    
-                    # Handle empty values - SSM doesn't allow empty strings
-                    # Use sentinel value "NONE" to indicate explicitly unset
-                    if not env_value or (isinstance(env_value, str) and env_value.strip() == ""):
-                        env_value = "NONE"
-                        logger.info(
-                            f"Environment variable {env_key} is empty - setting SSM parameter to 'NONE'. "
-                            f"Lambda function should treat 'NONE' as unset/disabled."
-                        )
-                    
-                    self.export_ssm_parameter(
-                        self,
-                        f"env-{env_key}-param",
-                        env_value,
-                        ssm_path,
-                        description=f"Configuration for Lambda@Edge: {env_key}"
-                    )
+        # Export the complete configuration as a single SSM parameter
+        config_ssm_path = f"/{self.deployment.environment}/{self.workload.name}/lambda-edge/config"
+        configuration = self.edge_config.dictionary.get("configuration", {})
+        environment_variables = configuration.get("environment_variables", {})
+        
+        # Build full configuration that Lambda@Edge expects
+        full_config = {
+            "environment_variables": environment_variables,
+            "runtime": configuration.get("runtime", {}),
+            "ui": configuration.get("ui", {})
+        }
+        
+        self.export_ssm_parameter(
+            self,
+            "full-config-param",
+            json.dumps(full_config),
+            config_ssm_path,
+            description=f"Complete Lambda@Edge configuration for {function_name} - update this for dynamic changes"
+        )
+        
+        # Export cache TTL parameter for dynamic cache control
+        cache_ttl_ssm_path = f"/{self.deployment.environment}/{self.workload.name}/lambda-edge/cache-ttl"
+        default_cache_ttl = self.edge_config.dictionary.get("cache_ttl_seconds", 300)  # Default 5 minutes
+        
+        self.export_ssm_parameter(
+            self,
+            "cache-ttl-param",
+            str(default_cache_ttl),
+            cache_ttl_ssm_path,
+            description=f"Lambda@Edge configuration cache TTL in seconds for {function_name} - adjust for maintenance windows (30-3600)"
+        )

cdk_factory/stack_library/load_balancer/load_balancer_stack.py

@@ -459,6 +459,10 @@ class LoadBalancerStack(IStack, VPCProviderMixin, StandardizedSsmMixin):
             # Parse AWS ALB conditions format
             aws_conditions = rule_config.get("conditions", [])
             for condition in aws_conditions:
+                enabled = str(condition.get("enabled", True)).lower()
+                if enabled != "true":
+                    continue
+                
                 field = condition.get("field")
                 if field == "http-header" and "http_header_config" in condition:
                     header_config = condition["http_header_config"]