cdk-factory 0.19.8__tar.gz → 0.19.10__tar.gz

{cdk_factory-0.19.8 → cdk_factory-0.19.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cdk_factory
-Version: 0.19.8
+Version: 0.19.10
 Summary: CDK Factory. A QuickStarter and best practices setup for CDK projects
 Author-email: Eric Wilson <eric.wilson@geekcafe.com>
 License: MIT License

{cdk_factory-0.19.8 → cdk_factory-0.19.10}/pyproject.toml

@@ -33,7 +33,7 @@ markers = [
 [project]
 
 name = "cdk_factory"
-version = "0.19.8"
+version = "0.19.10"
 authors = [
   { name="Eric Wilson", email="eric.wilson@geekcafe.com" }
 ]

{cdk_factory-0.19.8 → cdk_factory-0.19.10}/src/cdk_factory/stack_library/cloudfront/cloudfront_stack.py

@@ -145,7 +145,7 @@ class CloudFrontStack(IStack):
             return
 
         # Check if certificate ARN is provided
-        cert_arn = cert_config.get("arn")
+        cert_arn = self.resolve_ssm_value(self, cert_config.get("arn"), "CertificateARN")
         if cert_arn:
             self.certificate = acm.Certificate.from_certificate_arn(
                 self, "Certificate", certificate_arn=cert_arn
@@ -173,14 +173,14 @@ class CloudFrontStack(IStack):
                     "CloudFront certificates must be created in us-east-1"
                 )
                 return
-            
+
             # Create the certificate
             # Get hosted zone from SSM imports
             hosted_zone_id = cert_config.get("hosted_zone_id")
             hosted_zone = route53.HostedZone.from_hosted_zone_id(
                 self, "HostedZone", hosted_zone_id
             )
-            
+
             self.certificate = acm.Certificate(
                 self,
                 "Certificate",
@@ -223,7 +223,9 @@ class CloudFrontStack(IStack):
 
     def _create_custom_origin(self, config: Dict[str, Any]) -> cloudfront.IOrigin:
         """Create custom origin (ALB, API Gateway, etc.)"""
-        domain_name = self.resolve_ssm_value(self, config.get("domain_name"), config.get("domain_name"))
+        domain_name = self.resolve_ssm_value(
+            self, config.get("domain_name"), config.get("domain_name")
+        )
         origin_id = config.get("id")
 
         if not domain_name:
@@ -297,21 +299,22 @@ class CloudFrontStack(IStack):
 
     def _create_s3_origin(self, config: Dict[str, Any]) -> cloudfront.IOrigin:
         """Create S3 origin"""
-        bucket_name = self.resolve_ssm_value(self, config.get("bucket_name"), config.get("bucket_name"))
-        
+        bucket_name = self.resolve_ssm_value(
+            self, config.get("bucket_name"), config.get("bucket_name")
+        )
 
         origin_path = config.get("origin_path", "")
-        
+
         if not bucket_name:
             raise ValueError("S3 origin requires 'bucket_name' configuration")
-        
+
         # For S3 origins, we need to import the bucket by name
         bucket = s3.Bucket.from_bucket_name(
             self,
             id=f"S3OriginBucket-{config.get('id', 'unknown')}",
-            bucket_name=bucket_name
+            bucket_name=bucket_name,
         )
-        
+
         # Create S3 origin with OAC (Origin Access Control) for security
         origin = origins.S3BucketOrigin.with_origin_access_control(
             bucket,
@@ -321,7 +324,7 @@ class CloudFrontStack(IStack):
                 cloudfront.AccessLevel.LIST,
             ],
         )
-        
+
         return origin
 
     def _create_distribution(self) -> None:

{cdk_factory-0.19.8 → cdk_factory-0.19.10}/src/cdk_factory/stack_library/ecs/ecs_service_stack.py

@@ -226,6 +226,9 @@ class EcsServiceStack(IStack, VPCProviderMixin, StandardizedSsmMixin):
                     "CloudWatchAgentServerPolicy"
                 )
             )
+
+        # add any custom policies
+        self._add_custom_task_policies(task_role)
         
         # Create task definition based on launch type
         if self.ecs_config.launch_type == "EC2":
@@ -257,6 +260,37 @@ class EcsServiceStack(IStack, VPCProviderMixin, StandardizedSsmMixin):
         # Add containers
         self._add_containers_to_task()
 
+    def _add_custom_task_policies(self, task_role: iam.Role) -> None:
+        """
+        Add custom task policies to the task definition.
+        """
+        for policy in self.ecs_config.task_definition.get("policies", []):
+
+            effect = policy.get("effect", "Allow")
+            action = policy.get("action", None)
+            actions = policy.get("actions", [])
+            if action:
+                actions.append(action)
+            resources = policy.get("resources", [])
+            resource = policy.get("resource", None)
+            if resource:
+                resources.append(resource)
+
+            if effect == "Allow" and actions:
+                effect = iam.Effect.ALLOW
+            if effect == "Deny" and actions:
+                effect = iam.Effect.DENY
+
+            sid = policy.get("sid", None)
+            task_role.add_to_policy(
+                iam.PolicyStatement(
+                    effect=effect,
+                    actions=actions,
+                    resources=resources,
+                    sid=sid,
+                )
+            )
+
     def _add_volumes_to_task(self) -> None:
         """
         Add volumes to the task definition.

{cdk_factory-0.19.8 → cdk_factory-0.19.10}/src/cdk_factory/stack_library/lambda_edge/lambda_edge_stack.py

@@ -53,6 +53,8 @@ class LambdaEdgeStack(IStack, StandardizedSsmMixin):
         self.workload: Optional[WorkloadConfig] = None
         self.function: Optional[_lambda.Function] = None
         self.function_version: Optional[_lambda.Version] = None
+        # Cache for resolved environment variables to prevent duplicate construct creation
+        self._resolved_env_cache: Optional[Dict[str, str]] = None
 
     def build(
         self,
@@ -101,12 +103,32 @@ class LambdaEdgeStack(IStack, StandardizedSsmMixin):
         # Add outputs
         self._add_outputs(function_name)
 
+    def _sanitize_construct_name(self, name: str) -> str:
+        """
+        Create a deterministic, valid CDK construct name from any string.
+        Replaces non-alphanumeric characters with dashes and limits length.
+        """
+        # Replace non-alphanumeric characters with dashes
+        sanitized = ''.join(c if c.isalnum() else '-' for c in name)
+        # Remove consecutive dashes
+        while '--' in sanitized:
+            sanitized = sanitized.replace('--', '-')
+        # Remove leading/trailing dashes
+        sanitized = sanitized.strip('-')
+        # Limit to 255 characters (CDK limit)
+        return sanitized[:255]
+
     def _resolve_environment_variables(self) -> Dict[str, str]:
         """
         Resolve environment variables, including SSM parameter references.
         Supports {{ssm:parameter-path}} syntax for dynamic SSM lookups.
         Uses CDK tokens that resolve at deployment time, not synthesis time.
+        Caches results to prevent duplicate construct creation.
         """
+        # Return cached result if available
+        if self._resolved_env_cache is not None:
+            return self._resolved_env_cache
+        
         resolved_env = {}
         
         for key, value in self.edge_config.environment.items():
@@ -115,18 +137,23 @@ class LambdaEdgeStack(IStack, StandardizedSsmMixin):
                 # Extract SSM parameter path
                 ssm_param_path = value[6:-2]  # Remove {{ssm: and }}
                 
+                # Create deterministic construct name from parameter path
+                construct_name = self._sanitize_construct_name(f"env-{key}-{ssm_param_path}")
+                
                 # Import SSM parameter - this creates a token that resolves at deployment time
                 param = ssm.StringParameter.from_string_parameter_name(
                     self,
-                    f"env-{key}-{hash(ssm_param_path) % 10000}",
+                    construct_name,
                     ssm_param_path
                 )
                 resolved_value = param.string_value
-                logger.info(f"Resolved environment variable {key} from SSM {ssm_param_path}")
+                logger.info(f"Resolved environment variable {key} from SSM {ssm_param_path} as {construct_name}")
                 resolved_env[key] = resolved_value
             else:
                 resolved_env[key] = value
         
+        # Cache the result
+        self._resolved_env_cache = resolved_env
         return resolved_env
 
     def _create_lambda_function(self, function_name: str) -> None:

cdk_factory-0.19.10/src/cdk_factory/version.py

@@ -0,0 +1 @@
+__version__ = "0.19.10"

cdk_factory-0.19.8/src/cdk_factory/version.py

@@ -1 +0,0 @@
-__version__ = "0.19.8"