konokenj.cdk-api-mcp-server 0.31.0__py3-none-any.whl → 0.57.0__py3-none-any.whl

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ecs/integ.managedinstances-no-default-capacity-provider.ts

@@ -0,0 +1,107 @@
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as cdk from 'aws-cdk-lib';
+import * as ecs from 'aws-cdk-lib/aws-ecs';
+import * as integ from '@aws-cdk/integ-tests-alpha';
+
+const app = new cdk.App({
+  postCliContext: {
+    '@aws-cdk/aws-ecs:removeDefaultDeploymentAlarm': true,
+    '@aws-cdk/aws-ecs:enableImdsBlockingDeprecatedFeature': false,
+    '@aws-cdk/aws-ecs:disableEcsImdsBlocking': false,
+  },
+});
+const stack = new cdk.Stack(app, 'integ-managedinstances-no-default-capacity-provider');
+
+const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2, restrictDefaultSecurityGroup: false });
+const cluster = new ecs.Cluster(stack, 'ManagedInstancesCluster', {
+  vpc,
+});
+
+// Create IAM roles required for FMI following Omakase specifications
+const infrastructureRole = new iam.Role(stack, 'InfrastructureRole', {
+  roleName: 'InfrastructureRole',
+  assumedBy: new iam.ServicePrincipal('ecs.amazonaws.com'),
+  managedPolicies: [
+    iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonECSInfrastructureRolePolicyForManagedInstances'),
+  ],
+});
+
+const instanceRole = new iam.Role(stack, 'InstanceRole', {
+  roleName: 'InstanceRole',
+  assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
+  managedPolicies: [
+    iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonECSInstanceRolePolicyForManagedInstances'),
+  ],
+});
+
+infrastructureRole.grantPassRole(instanceRole);
+
+const instanceProfile = new iam.InstanceProfile(stack, 'InstanceProfile', {
+  instanceProfileName: 'InstanceProfile',
+  role: instanceRole,
+});
+
+// Create a security group for FMI instances
+const fmiSecurityGroup = new ec2.SecurityGroup(stack, 'ManagedInstancesSecurityGroup', {
+  vpc,
+  description: 'Security group for ManagedInstances capacity provider instances',
+  allowAllOutbound: true,
+});
+
+// Create MI Capacity Provider
+const miCapacityProvider = new ecs.ManagedInstancesCapacityProvider(stack, 'ManagedInstancesCapacityProvider', {
+  infrastructureRole: infrastructureRole,
+  ec2InstanceProfile: instanceProfile,
+  subnets: vpc.privateSubnets,
+  securityGroups: [fmiSecurityGroup],
+  propagateTags: ecs.PropagateManagedInstancesTags.CAPACITY_PROVIDER,
+  instanceRequirements: {
+    vCpuCountMin: 1,
+    memoryMin: cdk.Size.gibibytes(2),
+    cpuManufacturers: [ec2.CpuManufacturer.INTEL],
+    acceleratorManufacturers: [ec2.AcceleratorManufacturer.NVIDIA],
+  },
+});
+
+// Add FMI capacity provider to cluster
+cluster.addManagedInstancesCapacityProvider(miCapacityProvider);
+
+// Create a task definition compatible with Managed Instances and Fargate
+const taskDefinition = new ecs.TaskDefinition(stack, 'TaskDef', {
+  compatibility: ecs.Compatibility.FARGATE_AND_MANAGED_INSTANCES,
+  cpu: '256',
+  memoryMiB: '512',
+  networkMode: ecs.NetworkMode.AWS_VPC,
+});
+
+taskDefinition.addContainer('web', {
+  image: ecs.ContainerImage.fromRegistry('public.ecr.aws/docker/library/httpd:2.4'),
+  memoryLimitMiB: 512,
+  portMappings: [
+    {
+      containerPort: 80,
+      protocol: ecs.Protocol.TCP,
+    },
+  ],
+});
+
+// Create a service using the MI capacity provider
+new ecs.FargateService(stack, 'ManagedInstancesService', {
+  cluster,
+  taskDefinition,
+  capacityProviderStrategies: [
+    {
+      capacityProvider: miCapacityProvider.capacityProviderName,
+      weight: 1,
+    },
+  ],
+  desiredCount: 1,
+});
+
+new integ.IntegTest(app, 'ManagedInstancesCapacityProviders', {
+  testCases: [stack],
+  regions: ['us-west-2'],
+});
+
+app.synth();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ecs/integ.placement-strategies.ts

@@ -2,6 +2,7 @@ import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import * as cdk from 'aws-cdk-lib';
 import { Construct } from 'constructs';
 import * as ecs from 'aws-cdk-lib/aws-ecs';
+import * as integ from '@aws-cdk/integ-tests-alpha';
 
 const app = new cdk.App({
   postCliContext: {
@@ -12,24 +13,29 @@ const app = new cdk.App({
   },
 });
 
-class EcsStack extends cdk.Stack {
-  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
-    super(scope, id, props);
-
+class BaseEcsStack extends cdk.Stack {
+  protected createBaseResources() {
     const vpc = new ec2.Vpc(this, 'VPC', { restrictDefaultSecurityGroup: false });
-
     const cluster = new ecs.Cluster(this, 'EcsCluster', { vpc });
     cluster.addCapacity('DefaultAutoScalingGroup', {
       instanceType: ec2.InstanceType.of(ec2.InstanceClass.T2, ec2.InstanceSize.MICRO),
     });
-
     const taskDefinition = new ecs.Ec2TaskDefinition(this, 'TaskDef');
     taskDefinition.addContainer('web', {
       image: ecs.ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
       memoryLimitMiB: 256,
     });
+    return { vpc, cluster, taskDefinition };
+  }
+}
+
+// Test service with multiple placement strategies
+class EcsWithStrategiesStack extends BaseEcsStack {
+  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+    super(scope, id, props);
+    const { cluster, taskDefinition } = this.createBaseResources();
 
-    new ecs.Ec2Service(this, 'Test_Stack', {
+    new ecs.Ec2Service(this, 'Service', {
       cluster,
       taskDefinition,
       placementStrategies: [
@@ -40,6 +46,24 @@ class EcsStack extends cdk.Stack {
   }
 }
 
-new EcsStack(app, 'aws-cdk-ecs-integration-test-stack');
+// Test service with empty placement strategies
+class EcsWithEmptyStrategiesStack extends BaseEcsStack {
+  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+    super(scope, id, props);
+    const { cluster, taskDefinition } = this.createBaseResources();
+
+    new ecs.Ec2Service(this, 'Service', {
+      cluster,
+      taskDefinition,
+      placementStrategies: [],
+    });
+  }
+}
+new integ.IntegTest(app, 'LambdaTest', {
+  testCases: [
+    new EcsWithStrategiesStack(app, 'ecs-placement-strategies-with-strategies'),
+    new EcsWithEmptyStrategiesStack(app, 'ecs-placement-strategies-empty'),
+  ],
+});
 
 app.synth();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ecs/integ.pseudo-terminal.ts

@@ -3,25 +3,35 @@ import * as cdk from 'aws-cdk-lib';
 import * as integ from '@aws-cdk/integ-tests-alpha';
 import * as ecs from 'aws-cdk-lib/aws-ecs';
 
-const app = new cdk.App();
-const stack = new cdk.Stack(app, 'integ-pseudo-terminal');
+const app = new cdk.App({
+  postCliContext: {
+    '@aws-cdk/aws-lambda:useCdkManagedLogGroup': false,
+    '@aws-cdk/aws-ecs:enableImdsBlockingDeprecatedFeature': false,
+    '@aws-cdk/aws-ecs:disableEcsImdsBlocking': false,
+    '@aws-cdk/aws-lambda:createNewPoliciesWithAddToRolePolicy': false,
+  },
+});
+const stack = new cdk.Stack(app, 'aws-ecs-integ-pseudo-terminal');
 
 // Create a cluster
 const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2, restrictDefaultSecurityGroup: false });
 
 const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
-const taskDefinition = new ecs.FargateTaskDefinition(stack, 'TaskDef', {
-  cpu: 256,
-  memoryLimitMiB: 512,
+cluster.addCapacity('DefaultAutoScalingGroup', {
+  instanceType: new ec2.InstanceType('t2.micro'),
+});
+
+const taskDefinition = new ecs.Ec2TaskDefinition(stack, 'TaskDef', {
+  networkMode: ecs.NetworkMode.AWS_VPC,
 });
+
 taskDefinition.addContainer('web', {
   image: ecs.ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
-  memoryLimitMiB: 512,
-  cpu: 256,
+  memoryLimitMiB: 256,
   pseudoTerminal: true,
 });
 
-new ecs.FargateService(stack, 'Service', {
+new ecs.Ec2Service(stack, 'Service', {
   cluster,
   taskDefinition,
 });

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ecs-patterns/README.md

@@ -70,6 +70,8 @@ Fargate services will use the `LATEST` platform version by default, but you can
 
 Fargate services use the default VPC Security Group unless one or more are provided using the `securityGroups` property in the constructor.
 
+**Security Considerations**: When using custom security groups on your load balancer, the `openListener` property controls whether the load balancer listener allows traffic from anywhere on the internet (0.0.0.0/0). By default, `openListener` is `true`, but it will automatically default to `false` when custom security groups are detected, preventing unintended internet exposure. You can always explicitly set `openListener: true` to override this behavior if needed.
+
 By setting `redirectHTTP` to true, CDK will automatically create a listener on port 80 that redirects HTTP traffic to the HTTPS port.
 
 If you specify the option `recordType` you can decide if you want the construct to use CNAME or Route53-Aliases as record sets.

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ecs-patterns/integ.alb-fargate-service-public-private-switch.ts

@@ -0,0 +1,45 @@
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as ecs from 'aws-cdk-lib/aws-ecs';
+import * as cdk from 'aws-cdk-lib';
+import * as integ from '@aws-cdk/integ-tests-alpha';
+import * as ecsPatterns from 'aws-cdk-lib/aws-ecs-patterns';
+
+const app = new cdk.App();
+const stack = new cdk.Stack(app, 'aws-ecs-integ-alb-fargate-public-private-switch');
+
+const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2, restrictDefaultSecurityGroup: false });
+const cluster = new ecs.Cluster(stack, 'FargateCluster', { vpc });
+
+// Test private load balancer (the problematic case from the issue)
+new ecsPatterns.ApplicationLoadBalancedFargateService(stack, 'PrivateALBFargateService', {
+  cluster,
+  memoryLimitMiB: 1024,
+  cpu: 512,
+  publicLoadBalancer: false, // This should create ECSPrivate target group
+  taskImageOptions: {
+    image: ecs.ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
+  },
+});
+
+// Test public load balancer for comparison
+new ecsPatterns.ApplicationLoadBalancedFargateService(stack, 'PublicALBFargateService', {
+  cluster,
+  memoryLimitMiB: 1024,
+  cpu: 512,
+  publicLoadBalancer: true, // This should create ECS target group
+  taskImageOptions: {
+    image: ecs.ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
+  },
+});
+
+new integ.IntegTest(app, 'ALBFargatePublicPrivateSwitchTest', {
+  testCases: [stack],
+  allowDestroy: [
+    'PrivateALBFargateServiceLB3F43693F',
+    'PrivateALBFargateServiceLBPublicListenerECSPrivateGroup81AA5B8B',
+    'PublicALBFargateServiceLBBDD839E7',
+    'PublicALBFargateServiceLBPublicListenerECSGroupD991EA00',
+  ],
+});
+
+app.synth();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ecs-patterns/integ.alb-fargate-service-smart-defaults.ts

@@ -0,0 +1,143 @@
+/**
+ * Integration test for the conditional openListener behavior in ApplicationLoadBalancedFargateService.
+ *
+ * This test validates the security feature that automatically sets openListener to false when custom
+ * security groups are detected on the load balancer, preventing unintended internet exposure.
+ *
+ * Test scenarios:
+ * 1. DefaultService: No custom security groups provided
+ *    - Expected: openListener defaults to true, creates 0.0.0.0/0 ingress rules
+ *    - Validates: Default behavior when CDK manages all security groups
+ *
+ * 2. ExplicitOpenService: Explicit openListener: true
+ *    - Expected: Creates 0.0.0.0/0 ingress rules regardless of other settings
+ *    - Validates: Explicit override functionality works correctly
+ *
+ * 3. ExplicitClosedService: Explicit openListener: false
+ *    - Expected: Does NOT create 0.0.0.0/0 ingress rules
+ *    - Validates: Explicit closed listener prevents internet access
+ *
+ * 4. ConditionalWithCustomSG: Custom security groups + no explicit openListener
+ *    - Expected: Conditional behavior kicks in, openListener defaults to false
+ *    - Validates: Core feature - prevents 0.0.0.0/0 rules when custom SGs detected
+ *
+ * The test uses AWS SDK calls to verify actual security group configurations in deployed resources,
+ * ensuring the feature works correctly in real AWS environments.
+ */
+
+import { Vpc, SecurityGroup, Port } from 'aws-cdk-lib/aws-ec2';
+import { Cluster, ContainerImage } from 'aws-cdk-lib/aws-ecs';
+import { ApplicationLoadBalancer } from 'aws-cdk-lib/aws-elasticloadbalancingv2';
+import { App, Stack, Duration } from 'aws-cdk-lib';
+import * as integ from '@aws-cdk/integ-tests-alpha';
+import { ApplicationLoadBalancedFargateService } from 'aws-cdk-lib/aws-ecs-patterns';
+
+const app = new App({
+  postCliContext: {
+    // Enable the feature flag for this test
+    '@aws-cdk/aws-ecs-patterns:secGroupsDisablesImplicitOpenListener': true,
+  },
+});
+
+const stack = new Stack(app, 'aws-ecs-integ-alb-fg-smart-defaults');
+const vpc = new Vpc(stack, 'Vpc', { maxAzs: 3, natGateways: 1, restrictDefaultSecurityGroup: false });
+const cluster = new Cluster(stack, 'Cluster', { vpc });
+
+// Test case 1: Service with conditional default (no openListener specified)
+// CDK creates load balancer, should default to openListener: true (no custom security groups)
+new ApplicationLoadBalancedFargateService(stack, 'SmartDefaultService', {
+  cluster,
+  memoryLimitMiB: 512,
+  taskImageOptions: {
+    image: ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
+  },
+  // No openListener specified - should default to true since no custom security groups
+});
+
+// Test case 2: Service with explicit openListener: true
+new ApplicationLoadBalancedFargateService(stack, 'ExplicitOpenService', {
+  cluster,
+  memoryLimitMiB: 512,
+  taskImageOptions: {
+    image: ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
+  },
+  openListener: true, // Should create 0.0.0.0/0 rules
+  listenerPort: 8080,
+});
+
+// Test case 3: Service with explicit openListener: false
+new ApplicationLoadBalancedFargateService(stack, 'ExplicitClosedService', {
+  cluster,
+  memoryLimitMiB: 512,
+  taskImageOptions: {
+    image: ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
+  },
+  openListener: false, // Should NOT create 0.0.0.0/0 rules
+  listenerPort: 9090,
+});
+
+// Test case 4: Service with custom security groups (conditional default should apply)
+const customSecurityGroup = new SecurityGroup(stack, 'CustomSecurityGroup', {
+  vpc,
+  description: 'Custom security group for load balancer',
+});
+
+// Add a custom rule to the security group
+customSecurityGroup.addIngressRule(
+  customSecurityGroup,
+  Port.tcp(80),
+  'Allow HTTP from custom security group',
+);
+
+const customLoadBalancer = new ApplicationLoadBalancer(stack, 'CustomLoadBalancer', {
+  vpc,
+  internetFacing: true,
+  securityGroup: customSecurityGroup,
+});
+
+// This should use conditional default (openListener: false) because custom security groups are detected
+new ApplicationLoadBalancedFargateService(stack, 'SmartDefaultWithCustomSG', {
+  cluster,
+  memoryLimitMiB: 512,
+  taskImageOptions: {
+    image: ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
+  },
+  loadBalancer: customLoadBalancer,
+  // No openListener specified - should default to false due to custom security groups
+});
+
+const integTest = new integ.IntegTest(app, 'albFargateServiceSmartDefaultsTest', {
+  testCases: [stack],
+});
+
+// Validate the core conditional behavior by checking the custom security group
+// This confirms that when custom security groups are provided, the conditional default prevents
+// creating overly permissive 0.0.0.0/0 ingress rules
+// Assert that the custom security group only contains self-referencing rules (no 0.0.0.0/0)
+// This validates the feature prevents unintended internet exposure
+integTest.assertions.awsApiCall('EC2', 'describeSecurityGroups', {
+  GroupIds: [customSecurityGroup.securityGroupId],
+}).expect(integ.ExpectedResult.objectLike({
+  SecurityGroups: [
+    {
+      IpPermissions: integ.Match.arrayWith([
+        integ.Match.objectLike({
+          FromPort: 80,
+          ToPort: 80,
+          // Verify only security group references exist, no public internet access (0.0.0.0/0)
+          UserIdGroupPairs: integ.Match.arrayWith([
+            integ.Match.objectLike({
+              GroupId: customSecurityGroup.securityGroupId,
+            }),
+          ]),
+          // Ensure no IpRanges with 0.0.0.0/0 are present
+          IpRanges: [],
+        }),
+      ]),
+    },
+  ],
+})).waitForAssertions({
+  totalTimeout: Duration.minutes(5),
+});
+
+app.synth();