cdk-factory 0.7.29__tar.gz → 0.7.31__tar.gz

{cdk_factory-0.7.29 → cdk_factory-0.7.31}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cdk_factory
-Version: 0.7.29
+Version: 0.7.31
 Summary: CDK Factory. A QuickStarter and best practices setup for CDK projects
 Author-email: Eric Wilson <eric.wilson@geekcafe.com>
 License: MIT License

{cdk_factory-0.7.29 → cdk_factory-0.7.31}/pyproject.toml

@@ -33,7 +33,7 @@ markers = [
 [project]
 
 name = "cdk_factory"
-version = "0.7.29"
+version = "0.7.31"
 authors = [
   { name="Eric Wilson", email="eric.wilson@geekcafe.com" }
 ]

cdk_factory-0.7.31/src/cdk_factory/configurations/resources/rum.py

@@ -0,0 +1,135 @@
+"""
+Geek Cafe, LLC
+Maintainers: Eric Wilson
+MIT License.  See Project Root for the license information.
+"""
+
+from typing import Dict, Any, List, Optional
+from cdk_factory.configurations.enhanced_base_config import EnhancedBaseConfig
+
+
+class RumConfig(EnhancedBaseConfig):
+    """
+    RUM (Real User Monitoring) Configuration - supports CloudWatch RUM app monitor settings.
+    Each property reads from the config dict and provides sensible defaults.
+    """
+
+    def __init__(self, config: dict = None) -> None:
+        super().__init__(config or {}, resource_type="rum", resource_name=config.get("name", "rum") if config else "rum")
+        self.__config = config or {}
+
+    @property
+    def name(self) -> str:
+        """Name for the RUM app monitor"""
+        return self.__config.get("name", "app-monitor")
+
+    @property
+    def domain(self) -> Optional[str]:
+        """The top-level internet domain name for which your application has administrative authority"""
+        return self.__config.get("domain")
+
+    @property
+    def domain_list(self) -> Optional[List[str]]:
+        """A list of top-level internet domain names for which your application has administrative authority"""
+        return self.__config.get("domain_list")
+
+    @property
+    def cw_log_enabled(self) -> bool:
+        """Whether to send telemetry data to CloudWatch Logs (default: False)"""
+        return bool(self.__config.get("cw_log_enabled", False))
+
+    @property
+    def custom_events_enabled(self) -> bool:
+        """Whether custom events are enabled (default: False)"""
+        return bool(self.__config.get("custom_events_enabled", False))
+
+    # App Monitor Configuration Properties
+    @property
+    def allow_cookies(self) -> bool:
+        """Whether to allow cookies for user tracking (default: True)"""
+        return bool(self.__config.get("allow_cookies", True))
+
+    @property
+    def enable_xray(self) -> bool:
+        """Whether to enable X-Ray tracing (default: False)"""
+        return bool(self.__config.get("enable_xray", False))
+
+    @property
+    def excluded_pages(self) -> Optional[List[str]]:
+        """List of URLs to exclude from RUM data collection"""
+        return self.__config.get("excluded_pages")
+
+    @property
+    def included_pages(self) -> Optional[List[str]]:
+        """List of URLs to include in RUM data collection"""
+        return self.__config.get("included_pages")
+
+    @property
+    def favorite_pages(self) -> Optional[List[str]]:
+        """List of pages to mark as favorites in the RUM console"""
+        return self.__config.get("favorite_pages")
+
+    @property
+    def session_sample_rate(self) -> float:
+        """Portion of user sessions to sample (0.0 to 1.0, default: 0.1)"""
+        rate = self.__config.get("session_sample_rate", 0.1)
+        return float(rate) if rate is not None else 0.1
+
+    @property
+    def telemetries(self) -> List[str]:
+        """Types of telemetry data to collect (default: ['errors', 'performance', 'http'])"""
+        return self.__config.get("telemetries", ["errors", "performance", "http"])
+
+    # Cognito Integration Properties
+    @property
+    def cognito_identity_pool_id(self) -> Optional[str]:
+        """Existing Cognito Identity Pool ID to use for authorization"""
+        return self.__config.get("cognito_identity_pool_id")
+
+    @property
+    def cognito_user_pool_id(self) -> Optional[str]:
+        """Existing Cognito User Pool ID to reference"""
+        return self.__config.get("cognito_user_pool_id")
+
+    @property
+    def create_cognito_identity_pool(self) -> bool:
+        """Whether to create a new Cognito Identity Pool if none provided (default: True)"""
+        return bool(self.__config.get("create_cognito_identity_pool", True))
+
+    @property
+    def cognito_identity_pool_name(self) -> str:
+        """Name for the Cognito Identity Pool if creating one"""
+        return self.__config.get("cognito_identity_pool_name", f"{self.name}_identity_pool")
+
+    @property
+    def cognito_user_pool_name(self) -> str:
+        """Name for the Cognito User Pool if creating one"""
+        return self.__config.get("cognito_user_pool_name", f"{self.name}_user_pool")
+
+    @property
+    def create_cognito_user_pool(self) -> bool:
+        """Whether to create a new Cognito User Pool if none provided (default: True)"""
+        return bool(self.__config.get("create_cognito_user_pool", True))
+
+    # Metric Destinations
+    @property
+    def metric_destinations(self) -> Optional[List[Dict[str, Any]]]:
+        """List of metric destinations for extended metrics"""
+        return self.__config.get("metric_destinations")
+
+    # Tags
+    @property
+    def tags(self) -> Dict[str, str]:
+        """Tags to apply to the RUM app monitor"""
+        return self.__config.get("tags", {})
+
+    # SSM Integration
+    @property
+    def ssm_exports(self) -> Dict[str, str]:
+        """SSM parameter paths for exporting RUM resources"""
+        return self.__config.get("ssm_exports", {})
+
+    @property
+    def ssm_imports(self) -> Dict[str, str]:
+        """SSM parameter paths for importing external resources"""
+        return self.__config.get("ssm_imports", {})

{cdk_factory-0.7.29 → cdk_factory-0.7.31}/src/cdk_factory/constructs/cloudfront/cloudfront_distribution_construct.py

@@ -184,7 +184,29 @@ class CloudFrontDistributionConstruct(Construct):
         """
         function_associations = []
 
-        if self.restrict_to_known_hosts and self.aliases:
+        # Check if URL rewrite is enabled for SPA/static site routing
+        enable_url_rewrite = False
+        if self.stack_config and isinstance(self.stack_config, StackConfig):
+            cloudfront_config = self.stack_config.dictionary.get("cloudfront", {})
+            enable_url_rewrite = cloudfront_config.get("enable_url_rewrite", False)
+        
+        # CloudFront only allows ONE function per event type
+        # If both URL rewrite and host restrictions are needed, combine them
+        if enable_url_rewrite and self.restrict_to_known_hosts and self.aliases:
+            function_associations.append(
+                cloudfront.FunctionAssociation(
+                    function=self.__get_combined_function(hosts=self.aliases),
+                    event_type=cloudfront.FunctionEventType.VIEWER_REQUEST,
+                )
+            )
+        elif enable_url_rewrite:
+            function_associations.append(
+                cloudfront.FunctionAssociation(
+                    function=self.__get_url_rewrite_function(),
+                    event_type=cloudfront.FunctionEventType.VIEWER_REQUEST,
+                )
+            )
+        elif self.restrict_to_known_hosts and self.aliases:
             function_associations.append(
                 cloudfront.FunctionAssociation(
                     function=self.__get_cloudfront_host_restrictions(
@@ -196,6 +218,96 @@ class CloudFrontDistributionConstruct(Construct):
 
         return function_associations
 
+    def __get_combined_function(self, hosts: List[str]) -> cloudfront.Function:
+        """
+        Creates a combined CloudFront function that does both URL rewriting and host restrictions.
+        This is necessary because CloudFront only allows one function per event type.
+        
+        Args:
+            hosts: List of allowed hostnames
+            
+        Returns:
+            cloudfront.Function: Combined function
+        """
+        allowed_hosts = "[" + ", ".join(f"'{host}'" for host in hosts) + "]"
+        
+        function_code = f"""
+        function handler(event) {{
+            var request = event.request;
+            var allowedHosts = {allowed_hosts};
+            var hostHeader = request.headers.host.value;
+            
+            // Check host restrictions first
+            if (allowedHosts.indexOf(hostHeader) === -1) {{
+                return {{ statusCode: 403, statusDescription: 'Forbidden' }};
+            }}
+            
+            // Then do URL rewrite
+            var uri = request.uri;
+            
+            // If URI doesn't have a file extension and doesn't end with /
+            if (!uri.includes('.') && !uri.endsWith('/')) {{
+                request.uri = uri + '/index.html';
+            }}
+            // If URI ends with / but not index.html
+            else if (uri.endsWith('/') && !uri.endsWith('index.html')) {{
+                request.uri = uri + 'index.html';
+            }}
+            // If URI is exactly /
+            else if (uri === '/') {{
+                request.uri = '/index.html';
+            }}
+            
+            return request;
+        }}
+        """
+
+        combined_function = cloudfront.Function(
+            self,
+            "CombinedFunction",
+            comment="Combined URL rewrite and host restrictions for static site routing",
+            code=cloudfront.FunctionCode.from_inline(function_code),
+        )
+        return combined_function
+
+    def __get_url_rewrite_function(self) -> cloudfront.Function:
+        """
+        Creates a CloudFront function that rewrites URLs for SPA/static site routing.
+        This enables clean URLs by routing /about to /about/index.html
+        
+        Returns:
+            cloudfront.Function: URL rewrite function for static site routing
+        """
+        function_code = """
+        function handler(event) {
+            var request = event.request;
+            var uri = request.uri;
+            
+            // If URI doesn't have a file extension and doesn't end with /
+            if (!uri.includes('.') && !uri.endsWith('/')) {
+                request.uri = uri + '/index.html';
+            }
+            // If URI ends with / but not index.html
+            else if (uri.endsWith('/') && !uri.endsWith('index.html')) {
+                request.uri = uri + 'index.html';
+            }
+            // If URI is exactly /
+            else if (uri === '/') {
+                request.uri = '/index.html';
+            }
+            
+            return request;
+        }
+        """
+
+        url_rewrite_function = cloudfront.Function(
+            self,
+            "UrlRewriteFunction",
+            comment="Rewrites clean URLs to /folder/index.html for static site routing",
+            code=cloudfront.FunctionCode.from_inline(function_code),
+        )
+        return url_rewrite_function
+
     def __get_cloudfront_host_restrictions(
         self, hosts: List[str]
     ) -> cloudfront.Function:

cdk_factory-0.7.31/src/cdk_factory/stack_library/rum/__init__.py

@@ -0,0 +1,7 @@
+"""
+RUM Stack Library Module
+"""
+
+from .rum_stack import RumStack
+
+__all__ = ["RumStack"]

cdk_factory-0.7.31/src/cdk_factory/stack_library/rum/rum_stack.py

@@ -0,0 +1,332 @@
+"""
+Geek Cafe, LLC
+Maintainers: Eric Wilson
+MIT License.  See Project Root for the license information.
+"""
+
+import aws_cdk as cdk
+from aws_cdk import aws_rum as rum
+from aws_cdk import aws_cognito as cognito
+from aws_cdk import aws_iam as iam
+from constructs import Construct
+from aws_lambda_powertools import Logger
+from typing import Optional
+
+from cdk_factory.configurations.deployment import DeploymentConfig
+from cdk_factory.configurations.resources.rum import RumConfig
+from cdk_factory.configurations.stack import StackConfig
+from cdk_factory.interfaces.istack import IStack
+from cdk_factory.interfaces.enhanced_ssm_parameter_mixin import EnhancedSsmParameterMixin
+from cdk_factory.stack.stack_module_registry import register_stack
+from cdk_factory.workload.workload_factory import WorkloadConfig
+
+logger = Logger(__name__)
+
+
+@register_stack("rum_library_module")
+@register_stack("rum_stack")
+class RumStack(IStack, EnhancedSsmParameterMixin):
+    """
+    RUM Stack - Creates a CloudWatch RUM app monitor with optional Cognito integration.
+    Can either use existing Cognito resources or create new ones if not provided.
+    """
+
+    def __init__(self, scope: Construct, id: str, **kwargs) -> None:
+        super().__init__(scope, id, **kwargs)
+        self.id = id
+        self.stack_config: Optional[StackConfig] = None
+        self.deployment: Optional[DeploymentConfig] = None
+        self.rum_config: Optional[RumConfig] = None
+        self.app_monitor: Optional[rum.CfnAppMonitor] = None
+        self.identity_pool: Optional[cognito.CfnIdentityPool] = None
+        self.user_pool: Optional[cognito.UserPool] = None
+
+    def build(
+        self,
+        stack_config: StackConfig,
+        deployment: DeploymentConfig,
+        workload: WorkloadConfig,
+    ) -> None:
+        """Build the RUM stack"""
+        self.stack_config = stack_config
+        self.deployment = deployment
+        self.rum_config = RumConfig(stack_config.dictionary.get("rum", {}))
+        
+        logger.info(f"Building RUM stack: {self.rum_config.name}")
+
+        # Setup enhanced SSM integration
+        self.setup_enhanced_ssm_integration(
+            scope=self,
+            config=stack_config.dictionary.get("rum", {}),
+            resource_type="rum",
+            resource_name=self.rum_config.name
+        )
+
+        # Import or create Cognito resources
+        identity_pool_id, guest_role_arn = self._setup_cognito_integration()
+
+        # Create the RUM app monitor
+        self._create_app_monitor(identity_pool_id, guest_role_arn)
+
+        # Export resources to SSM
+        self._export_ssm_parameters()
+
+    def _setup_cognito_integration(self) -> tuple[str, str]:
+        """
+        Setup Cognito integration - either import existing resources or create new ones.
+        Returns (identity_pool_id, guest_role_arn)
+        """
+        identity_pool_id = None
+        guest_role_arn = None
+
+        # Try to import existing Cognito Identity Pool ID from SSM or config
+        if self.rum_config.cognito_identity_pool_id:
+            identity_pool_id = self.rum_config.cognito_identity_pool_id
+            logger.info(f"Using existing Cognito Identity Pool: {identity_pool_id}")
+        else:
+            # Try to import from SSM using enhanced SSM pattern
+            imported_values = self.auto_import_resources({
+                "cognito_identity_pool_id": "auto"
+            })
+            
+            if imported_values.get("cognito_identity_pool_id"):
+                identity_pool_id = imported_values["cognito_identity_pool_id"]
+                logger.info(f"Imported Cognito Identity Pool from SSM: {identity_pool_id}")
+
+        # If no existing identity pool found, create new Cognito resources
+        if not identity_pool_id and self.rum_config.create_cognito_identity_pool:
+            identity_pool_id, guest_role_arn = self._create_cognito_resources()
+
+        # If we still don't have an identity pool, create a minimal one
+        if not identity_pool_id:
+            identity_pool_id, guest_role_arn = self._create_minimal_identity_pool()
+
+        return identity_pool_id, guest_role_arn
+
+    def _create_cognito_resources(self) -> tuple[str, str]:
+        """Create new Cognito User Pool and Identity Pool for RUM"""
+        logger.info("Creating new Cognito resources for RUM")
+
+        # Create User Pool if needed
+        user_pool_id = self.rum_config.cognito_user_pool_id
+        if not user_pool_id and self.rum_config.create_cognito_user_pool:
+            self.user_pool = cognito.UserPool(
+                self,
+                id=self.deployment.build_resource_name(f"{self.rum_config.name}-user-pool"),
+                user_pool_name=self.rum_config.cognito_user_pool_name,
+                self_sign_up_enabled=True,
+                sign_in_aliases=cognito.SignInAliases(email=True),
+                auto_verify=cognito.AutoVerifiedAttrs(email=True),
+                removal_policy=cdk.RemovalPolicy.DESTROY
+            )
+            user_pool_id = self.user_pool.user_pool_id
+            logger.info(f"Created Cognito User Pool: {user_pool_id}")
+
+        # Create Identity Pool
+        identity_pool_providers = []
+        if user_pool_id and self.user_pool:
+            # Create User Pool Client for Identity Pool integration
+            user_pool_client = cognito.UserPoolClient(
+                self,
+                id=self.deployment.build_resource_name(f"{self.rum_config.name}-user-pool-client"),
+                user_pool=self.user_pool,
+                generate_secret=False,
+                auth_flows=cognito.AuthFlow(
+                    user_srp=True,
+                    user_password=True
+                )
+            )
+            
+            identity_pool_providers.append({
+                "providerName": f"cognito-idp.{self.region}.amazonaws.com/{user_pool_id}",
+                "providerType": "COGNITO_USER_POOLS",
+                "clientId": user_pool_client.user_pool_client_id
+            })
+
+        self.identity_pool = cognito.CfnIdentityPool(
+            self,
+            id=self.deployment.build_resource_name(f"{self.rum_config.name}-identity-pool"),
+            identity_pool_name=self.rum_config.cognito_identity_pool_name,
+            allow_unauthenticated_identities=True,
+            cognito_identity_providers=identity_pool_providers if identity_pool_providers else None
+        )
+
+        # Create IAM role for unauthenticated users (guest role)
+        guest_role = iam.Role(
+            self,
+            id=self.deployment.build_resource_name(f"{self.rum_config.name}-guest-role"),
+            assumed_by=iam.FederatedPrincipal(
+                "cognito-identity.amazonaws.com",
+                conditions={
+                    "StringEquals": {
+                        "cognito-identity.amazonaws.com:aud": self.identity_pool.ref
+                    },
+                    "ForAnyValue:StringLike": {
+                        "cognito-identity.amazonaws.com:amr": "unauthenticated"
+                    }
+                }
+            ),
+            inline_policies={
+                "RUMPolicy": iam.PolicyDocument(
+                    statements=[
+                        iam.PolicyStatement(
+                            effect=iam.Effect.ALLOW,
+                            actions=[
+                                "rum:PutRumEvents"
+                            ],
+                            resources=[f"arn:aws:rum:{self.region}:{self.account}:appmonitor/{self.rum_config.name}"]
+                        )
+                    ]
+                )
+            }
+        )
+
+        # Attach the role to the identity pool
+        cognito.CfnIdentityPoolRoleAttachment(
+            self,
+            id=self.deployment.build_resource_name(f"{self.rum_config.name}-role-attachment"),
+            identity_pool_id=self.identity_pool.ref,
+            roles={
+                "unauthenticated": guest_role.role_arn
+            }
+        )
+
+        logger.info(f"Created Cognito Identity Pool: {self.identity_pool.ref}")
+        return self.identity_pool.ref, guest_role.role_arn
+
+    def _create_minimal_identity_pool(self) -> tuple[str, str]:
+        """Create a minimal identity pool for RUM when no Cognito resources are provided"""
+        logger.info("Creating minimal Cognito Identity Pool for RUM")
+
+        self.identity_pool = cognito.CfnIdentityPool(
+            self,
+            id=self.deployment.build_resource_name(f"{self.rum_config.name}-minimal-identity-pool"),
+            identity_pool_name=f"{self.rum_config.name}_minimal_identity_pool",
+            allow_unauthenticated_identities=True
+        )
+
+        # Create minimal IAM role for unauthenticated users
+        guest_role = iam.Role(
+            self,
+            id=self.deployment.build_resource_name(f"{self.rum_config.name}-minimal-guest-role"),
+            assumed_by=iam.FederatedPrincipal(
+                "cognito-identity.amazonaws.com",
+                conditions={
+                    "StringEquals": {
+                        "cognito-identity.amazonaws.com:aud": self.identity_pool.ref
+                    },
+                    "ForAnyValue:StringLike": {
+                        "cognito-identity.amazonaws.com:amr": "unauthenticated"
+                    }
+                }
+            ),
+            inline_policies={
+                "RUMPolicy": iam.PolicyDocument(
+                    statements=[
+                        iam.PolicyStatement(
+                            effect=iam.Effect.ALLOW,
+                            actions=[
+                                "rum:PutRumEvents"
+                            ],
+                            resources=[f"arn:aws:rum:{self.region}:{self.account}:appmonitor/{self.rum_config.name}"]
+                        )
+                    ]
+                )
+            }
+        )
+
+        # Attach the role to the identity pool
+        cognito.CfnIdentityPoolRoleAttachment(
+            self,
+            id=self.deployment.build_resource_name(f"{self.rum_config.name}-minimal-role-attachment"),
+            identity_pool_id=self.identity_pool.ref,
+            roles={
+                "unauthenticated": guest_role.role_arn
+            }
+        )
+
+        return self.identity_pool.ref, guest_role.role_arn
+
+    def _create_app_monitor(self, identity_pool_id: str, guest_role_arn: Optional[str]) -> None:
+        """Create the CloudWatch RUM app monitor"""
+        logger.info(f"Creating RUM app monitor: {self.rum_config.name}")
+
+        # Build app monitor configuration
+        app_monitor_config = rum.CfnAppMonitor.AppMonitorConfigurationProperty(
+            identity_pool_id=identity_pool_id,
+            guest_role_arn=guest_role_arn,
+            allow_cookies=self.rum_config.allow_cookies,
+            enable_x_ray=self.rum_config.enable_xray,
+            session_sample_rate=self.rum_config.session_sample_rate,
+            telemetries=self.rum_config.telemetries
+        )
+
+        # Add optional properties
+        if self.rum_config.excluded_pages:
+            app_monitor_config.excluded_pages = self.rum_config.excluded_pages
+        
+        if self.rum_config.included_pages:
+            app_monitor_config.included_pages = self.rum_config.included_pages
+            
+        if self.rum_config.favorite_pages:
+            app_monitor_config.favorite_pages = self.rum_config.favorite_pages
+
+        if self.rum_config.metric_destinations:
+            app_monitor_config.metric_destinations = [
+                rum.CfnAppMonitor.MetricDestinationProperty(**dest)
+                for dest in self.rum_config.metric_destinations
+            ]
+
+        # Create custom events configuration if enabled
+        custom_events = None
+        if self.rum_config.custom_events_enabled:
+            custom_events = rum.CfnAppMonitor.CustomEventsProperty(
+                status="ENABLED"
+            )
+
+        # Create the app monitor
+        self.app_monitor = rum.CfnAppMonitor(
+            self,
+            id=self.deployment.build_resource_name(f"{self.rum_config.name}-app-monitor"),
+            name=self.rum_config.name,
+            app_monitor_configuration=app_monitor_config,
+            domain=self.rum_config.domain,
+            domain_list=self.rum_config.domain_list,
+            cw_log_enabled=self.rum_config.cw_log_enabled,
+            custom_events=custom_events
+        )
+
+        # Add tags if specified
+        if self.rum_config.tags:
+            for key, value in self.rum_config.tags.items():
+                cdk.Tags.of(self.app_monitor).add(key, value)
+
+        logger.info(f"Created RUM app monitor: {self.app_monitor.name}")
+
+    def _export_ssm_parameters(self) -> None:
+        """Export RUM resources to SSM using enhanced SSM parameter mixin"""
+        if not self.app_monitor:
+            logger.warning("No app monitor to export")
+            return
+
+        # Prepare resource values for export
+        resource_values = {
+            "app_monitor_name": self.app_monitor.name,
+            "app_monitor_id": self.app_monitor.ref,
+        }
+
+        # Add identity pool info if available
+        if self.identity_pool:
+            resource_values["identity_pool_id"] = self.identity_pool.ref
+
+        # Add user pool info if available
+        if self.user_pool:
+            resource_values["user_pool_id"] = self.user_pool.user_pool_id
+
+        # Use enhanced SSM parameter export
+        exported_params = self.auto_export_resources(resource_values)
+        
+        if exported_params:
+            logger.info(f"Exported {len(exported_params)} RUM parameters to SSM")
+        else:
+            logger.info("No SSM parameters configured for export")

cdk_factory-0.7.31/src/cdk_factory/version.py

@@ -0,0 +1 @@
+__version__ = "0.7.31"

cdk_factory-0.7.29/src/cdk_factory/version.py

@@ -1 +0,0 @@
-__version__ = "0.7.29"