cdk-factory 0.19.9__tar.gz → 0.19.10__tar.gz

{cdk_factory-0.19.9 → cdk_factory-0.19.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cdk_factory
-Version: 0.19.9
+Version: 0.19.10
 Summary: CDK Factory. A QuickStarter and best practices setup for CDK projects
 Author-email: Eric Wilson <eric.wilson@geekcafe.com>
 License: MIT License

{cdk_factory-0.19.9 → cdk_factory-0.19.10}/pyproject.toml

@@ -33,7 +33,7 @@ markers = [
 [project]
 
 name = "cdk_factory"
-version = "0.19.9"
+version = "0.19.10"
 authors = [
   { name="Eric Wilson", email="eric.wilson@geekcafe.com" }
 ]

{cdk_factory-0.19.9 → cdk_factory-0.19.10}/src/cdk_factory/stack_library/cloudfront/cloudfront_stack.py

@@ -145,7 +145,7 @@ class CloudFrontStack(IStack):
             return
 
         # Check if certificate ARN is provided
-        cert_arn = cert_config.get("arn")
+        cert_arn = self.resolve_ssm_value(self, cert_config.get("arn"), "CertificateARN")
         if cert_arn:
             self.certificate = acm.Certificate.from_certificate_arn(
                 self, "Certificate", certificate_arn=cert_arn
@@ -173,14 +173,14 @@ class CloudFrontStack(IStack):
                     "CloudFront certificates must be created in us-east-1"
                 )
                 return
-            
+
             # Create the certificate
             # Get hosted zone from SSM imports
             hosted_zone_id = cert_config.get("hosted_zone_id")
             hosted_zone = route53.HostedZone.from_hosted_zone_id(
                 self, "HostedZone", hosted_zone_id
             )
-            
+
             self.certificate = acm.Certificate(
                 self,
                 "Certificate",
@@ -223,7 +223,9 @@ class CloudFrontStack(IStack):
 
     def _create_custom_origin(self, config: Dict[str, Any]) -> cloudfront.IOrigin:
         """Create custom origin (ALB, API Gateway, etc.)"""
-        domain_name = self.resolve_ssm_value(self, config.get("domain_name"), config.get("domain_name"))
+        domain_name = self.resolve_ssm_value(
+            self, config.get("domain_name"), config.get("domain_name")
+        )
         origin_id = config.get("id")
 
         if not domain_name:
@@ -297,21 +299,22 @@ class CloudFrontStack(IStack):
 
     def _create_s3_origin(self, config: Dict[str, Any]) -> cloudfront.IOrigin:
         """Create S3 origin"""
-        bucket_name = self.resolve_ssm_value(self, config.get("bucket_name"), config.get("bucket_name"))
-        
+        bucket_name = self.resolve_ssm_value(
+            self, config.get("bucket_name"), config.get("bucket_name")
+        )
 
         origin_path = config.get("origin_path", "")
-        
+
         if not bucket_name:
             raise ValueError("S3 origin requires 'bucket_name' configuration")
-        
+
         # For S3 origins, we need to import the bucket by name
         bucket = s3.Bucket.from_bucket_name(
             self,
             id=f"S3OriginBucket-{config.get('id', 'unknown')}",
-            bucket_name=bucket_name
+            bucket_name=bucket_name,
         )
-        
+
         # Create S3 origin with OAC (Origin Access Control) for security
         origin = origins.S3BucketOrigin.with_origin_access_control(
             bucket,
@@ -321,7 +324,7 @@ class CloudFrontStack(IStack):
                 cloudfront.AccessLevel.LIST,
             ],
         )
-        
+
         return origin
 
     def _create_distribution(self) -> None:

{cdk_factory-0.19.9 → cdk_factory-0.19.10}/src/cdk_factory/stack_library/ecs/ecs_service_stack.py

@@ -226,6 +226,9 @@ class EcsServiceStack(IStack, VPCProviderMixin, StandardizedSsmMixin):
                     "CloudWatchAgentServerPolicy"
                 )
             )
+
+        # add any custom policies
+        self._add_custom_task_policies(task_role)
         
         # Create task definition based on launch type
         if self.ecs_config.launch_type == "EC2":
@@ -257,6 +260,37 @@ class EcsServiceStack(IStack, VPCProviderMixin, StandardizedSsmMixin):
         # Add containers
         self._add_containers_to_task()
 
+    def _add_custom_task_policies(self, task_role: iam.Role) -> None:
+        """
+        Add custom task policies to the task definition.
+        """
+        for policy in self.ecs_config.task_definition.get("policies", []):
+
+            effect = policy.get("effect", "Allow")
+            action = policy.get("action", None)
+            actions = policy.get("actions", [])
+            if action:
+                actions.append(action)
+            resources = policy.get("resources", [])
+            resource = policy.get("resource", None)
+            if resource:
+                resources.append(resource)
+
+            if effect == "Allow" and actions:
+                effect = iam.Effect.ALLOW
+            if effect == "Deny" and actions:
+                effect = iam.Effect.DENY
+
+            sid = policy.get("sid", None)
+            task_role.add_to_policy(
+                iam.PolicyStatement(
+                    effect=effect,
+                    actions=actions,
+                    resources=resources,
+                    sid=sid,
+                )
+            )
+
     def _add_volumes_to_task(self) -> None:
         """
         Add volumes to the task definition.

cdk_factory-0.19.10/src/cdk_factory/version.py

@@ -0,0 +1 @@
+__version__ = "0.19.10"

cdk_factory-0.19.9/src/cdk_factory/version.py

@@ -1 +0,0 @@
-__version__ = "0.19.9"