Initial jenkins version

2025-06-25 13:22:01 +02:00
parent b5849c7fbd
commit 0e4f834409
12 changed files with 5069 additions and 0 deletions
@@ -0,0 +1,99 @@
+import {
+    Stack,
+    StackProps,
+    aws_apigateway as apigateway,
+    aws_lambda,
+    aws_ec2,
+    Duration,
+} from 'aws-cdk-lib';
+import * as aws_lambda_python_alpha from '@aws-cdk/aws-lambda-python-alpha';
+import { Construct } from 'constructs';
+import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
+import { join } from 'path';
+import { Runtime } from 'aws-cdk-lib/aws-lambda';
+import { BuildConfig } from '../utils/build-config';
+import { Period } from 'aws-cdk-lib/aws-apigateway';
+import { RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { VpcEndpoint, VpcEndpointService } from 'aws-cdk-lib/aws-ec2';
+import { PolicyStatement, PolicyDocument, Effect, AnyPrincipal } from 'aws-cdk-lib/aws-iam';
+
+
+export class MccAPIInfraStack extends Stack {
+    public readonly api: apigateway.RestApi;
+
+    constructor(
+        scope: Construct,
+        id: string,
+        buildConfig: BuildConfig,
+        props: StackProps,
+    ) {
+        super(scope, id, props);
+
+        const stackName = `${buildConfig.Environment}${buildConfig.ApplicationShortName}`;
+
+        const vpc = aws_ec2.Vpc.fromLookup(this, `${stackName}Vpc`, {
+            vpcId: buildConfig.Parameters.VPC,
+        });
+
+        const executeApiVpcEndpointSecurityGroup = new aws_ec2.SecurityGroup(this, `${stackName}ExecuteApiVPCEsg`, {
+            vpc,
+            description: 'Security group for API Gateway VPC Endpoint',
+            allowAllOutbound: true,
+        });
+
+        executeApiVpcEndpointSecurityGroup.addIngressRule(
+            aws_ec2.Peer.ipv4('10.0.0.0/8'),
+            aws_ec2.Port.tcp(443),
+            'Allow inbound HTTPS traffic from 10.0.0.0/8'
+        );
+
+        const executeApiVpcEndpoint = new aws_ec2.InterfaceVpcEndpoint(this, `${stackName}ExecuteApiVPCE`, {
+            vpc,
+            service: aws_ec2.InterfaceVpcEndpointAwsService.APIGATEWAY,
+            privateDnsEnabled: true,
+            subnets: { subnetType: aws_ec2.SubnetType.PRIVATE_WITH_EGRESS },
+            securityGroups: [executeApiVpcEndpointSecurityGroup]
+        });
+
+        const lambdaFunction = new aws_lambda_python_alpha.PythonFunction(this, `${stackName}MCCApp`, {
+            runtime: Runtime.PYTHON_3_11,
+            handler: 'lambda_handler',
+            timeout: Duration.seconds(30),
+            entry: join(__dirname, '../../src'),
+            index: 'run.py',
+            memorySize: 256,
+            vpc,
+            logRetention: RetentionDays.ONE_WEEK,
+        });
+
+        const api = new apigateway.LambdaRestApi(this, `${stackName}MCCAPI`, {
+            handler: lambdaFunction,
+            proxy: true,
+            deployOptions: {
+                stageName: buildConfig.Environment,
+            },
+            restApiName: `${buildConfig.ApplicationName} API`,
+            description: `API for ${buildConfig.ApplicationName} in ${buildConfig.Environment}`,
+            endpointConfiguration: {
+                types: [apigateway.EndpointType.PRIVATE],
+                vpcEndpoints: [executeApiVpcEndpoint],
+            },
+            policy: new PolicyDocument({
+                statements: [
+                    new PolicyStatement({
+                        effect: Effect.ALLOW,
+                        principals: [new AnyPrincipal()],
+                        actions: ['execute-api:Invoke'],
+                        resources: ['execute-api:/*'],
+                        // Optionally, restrict by source VPC or VPC endpoint
+                        conditions: {
+                             StringEquals: { 'aws:SourceVpce': executeApiVpcEndpoint.vpcEndpointId }
+                         }
+                    }),
+                ],
+            }),
+        });
+
+        this.api = api;
+    }
+}
@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import * as cdk from 'aws-cdk-lib';
+import { getConfig, BuildConfig } from '../utils/build-config';
+import { MccAPIInfraStack } from './apiStack';
+import { MccDBInfraStack } from './rdsStack';
+
+const app = new cdk.App();
+const buildConfig: BuildConfig = getConfig(app);
+
+const qualifier = process.env.CDK_QUALIFIER;
+
+const stackName = `${buildConfig.Environment}${buildConfig.ApplicationShortName}`;
+
+cdk.Tags.of(app).add('App', buildConfig.ApplicationName);
+cdk.Tags.of(app).add('Environment', buildConfig.Environment);
+cdk.Tags.of(app).add('AppManagerCFNStackKey', stackName);
+cdk.Tags.of(app).add('purpose', `${buildConfig.Environment}-${buildConfig.ApplicationShortName}`);
+
+const env: cdk.Environment = {
+  account: buildConfig.Account ?? process.env.CDK_DEPLOY_ACCOUNT ?? process.env.CDK_DEFAULT_ACCOUNT,
+  region: buildConfig.Region ?? process.env.CDK_DEPLOY_REGION ?? process.env.CDK_DEFAULT_REGION,
+};
+
+const apiStack = new MccAPIInfraStack(app, `${stackName}MCCAPI`, buildConfig, {
+  env,
+  description: `API stack for ${buildConfig.ApplicationName} in ${buildConfig.Environment}`,
+  synthesizer: new cdk.DefaultStackSynthesizer({
+    qualifier,
+  }),
+});
+
+const dbStack = new MccDBInfraStack(app, `${stackName}MCCDB`, buildConfig, {
+  env,
+  description: `Database stack for ${buildConfig.ApplicationName} in ${buildConfig.Environment}`,
+  synthesizer: new cdk.DefaultStackSynthesizer({
+    qualifier,
+  }),
+});
+
@@ -0,0 +1,79 @@
+import {
+  Stack,
+  aws_ec2 as ec2,
+  aws_rds as rds,
+  StackProps,
+  RemovalPolicy,
+} from 'aws-cdk-lib';
+import { Port } from 'aws-cdk-lib/aws-ec2';
+import { Construct } from 'constructs';
+import { BuildConfig } from '../utils/build-config';
+import { ClusterInstance } from 'aws-cdk-lib/aws-rds';
+
+export class MccDBInfraStack extends Stack {
+  public readonly mccDB: rds.DatabaseCluster;
+  public readonly mccDBSecurityGroup: ec2.SecurityGroup;
+
+  credentials = rds.Credentials.fromGeneratedSecret('mccAdmin');
+
+  constructor(scope: Construct, id: string, buildConfig: BuildConfig, props: StackProps) {
+    super(scope, id, props);
+
+    const vpc = ec2.Vpc.fromLookup(
+      this,
+      `${buildConfig.Environment}-${buildConfig.ApplicationShortName}MccVPC`,
+      {
+        vpcId: buildConfig.Parameters.VPC,
+      }
+    );
+
+    const dbSecurityGroup = new ec2.SecurityGroup(
+      this,
+      `${buildConfig.Environment}${buildConfig.ApplicationShortName}MccDBSecurityGroup`,
+      {
+        vpc: vpc,
+        securityGroupName: `${buildConfig.Environment}-${buildConfig.ApplicationShortName}DBSecurityGroup`,
+      }
+    );
+
+    const mccDB = new rds.DatabaseCluster(this, `${buildConfig.Environment}${buildConfig.ApplicationShortName}MccDB`, {
+        engine: rds.DatabaseClusterEngine.auroraPostgres({
+            version: rds.AuroraPostgresEngineVersion.VER_17_4,
+            }) ,
+        vpc,
+        writer: ClusterInstance.serverlessV2('writer') ,
+        credentials: this.credentials,
+        defaultDatabaseName: 'mccdb',
+        securityGroups: [dbSecurityGroup],
+        serverlessV2MinCapacity: 0,
+        serverlessV2MaxCapacity: 64,
+        enableDataApi: true,
+        clusterIdentifier: `${buildConfig.Environment}-${buildConfig.ApplicationShortName}-mccdb`,
+        removalPolicy: RemovalPolicy.RETAIN
+    });
+
+    const lambdaSecurityGroup = new ec2.SecurityGroup(
+      this,
+      `${buildConfig.Environment}${buildConfig.ApplicationShortName}MccDBLambdaSecurityGroup`,
+      {
+        vpc: vpc,
+        securityGroupName: `${buildConfig.Environment}-${buildConfig.ApplicationShortName}DBLambdaSecurityGroup`,
+      }
+    );
+
+    dbSecurityGroup.addIngressRule(
+      lambdaSecurityGroup,
+      Port.tcp(mccDB.clusterEndpoint.port),
+      'Allow connection from Lambda Function to DB'
+    );
+
+    dbSecurityGroup.addIngressRule(
+      ec2.Peer.ipv4('10.0.0.0/8'),
+      Port.tcp(mccDB.clusterEndpoint.port),
+      'Allow connection from internal network'
+    );
+
+    this.mccDB = mccDB;
+    this.mccDBSecurityGroup = lambdaSecurityGroup;
+  }
+}
@@ -0,0 +1,34 @@
+{
+  "vpc-provider:account=030215556060:filter.vpc-id=vpc-02e23456a3e6064f1:region=eu-west-1:returnAsymmetricSubnets=true": {
+    "vpcId": "vpc-02e23456a3e6064f1",
+    "vpcCidrBlock": "10.157.7.0/24",
+    "ownerAccountId": "030215556060",
+    "availabilityZones": [],
+    "subnetGroups": [
+      {
+        "name": "Private",
+        "type": "Private",
+        "subnets": [
+          {
+            "subnetId": "subnet-014953bcd8175abe5",
+            "cidr": "10.157.7.0/25",
+            "availabilityZone": "eu-west-1a",
+            "routeTableId": "rtb-0e60c84be1611577e"
+          },
+          {
+            "subnetId": "subnet-0fb151177f9b7d430",
+            "cidr": "10.157.7.128/26",
+            "availabilityZone": "eu-west-1b",
+            "routeTableId": "rtb-09dc6ac1e26eb92ba"
+          },
+          {
+            "subnetId": "subnet-0696d516a7e905674",
+            "cidr": "10.157.7.192/26",
+            "availabilityZone": "eu-west-1c",
+            "routeTableId": "rtb-04cc2504f623b4d2e"
+          }
+        ]
+      }
+    ]
+  }
+}
@@ -0,0 +1,110 @@
+{
+  "app": "npx ts-node --prefer-ts-exts bin/infra.ts",
+  "watch": {
+    "include": [
+      "**"
+    ],
+    "exclude": [
+      "README.md",
+      "cdk*.json",
+      "**/*.d.ts",
+      "**/*.js",
+      "tsconfig.json",
+      "package*.json",
+      "yarn.lock",
+      "node_modules",
+      "test"
+    ]
+  },
+  "context": {
+    "@aws-cdk/aws-lambda:recognizeLayerVersion": true,
+    "@aws-cdk/core:checkSecretUsage": true,
+    "@aws-cdk/core:target-partitions": [
+      "aws",
+      "aws-cn"
+    ],
+    "@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver": true,
+    "@aws-cdk/aws-ec2:uniqueImdsv2TemplateName": true,
+    "@aws-cdk/aws-ecs:arnFormatIncludesClusterName": true,
+    "@aws-cdk/aws-iam:minimizePolicies": true,
+    "@aws-cdk/core:validateSnapshotRemovalPolicy": true,
+    "@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName": true,
+    "@aws-cdk/aws-s3:createDefaultLoggingPolicy": true,
+    "@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption": true,
+    "@aws-cdk/aws-apigateway:disableCloudWatchRole": true,
+    "@aws-cdk/core:enablePartitionLiterals": true,
+    "@aws-cdk/aws-events:eventsTargetQueueSameAccount": true,
+    "@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker": true,
+    "@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName": true,
+    "@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy": true,
+    "@aws-cdk/aws-route53-patters:useCertificate": true,
+    "@aws-cdk/customresources:installLatestAwsSdkDefault": false,
+    "@aws-cdk/aws-rds:databaseProxyUniqueResourceName": true,
+    "@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup": true,
+    "@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId": true,
+    "@aws-cdk/aws-ec2:launchTemplateDefaultUserData": true,
+    "@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments": true,
+    "@aws-cdk/aws-redshift:columnId": true,
+    "@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2": true,
+    "@aws-cdk/aws-ec2:restrictDefaultSecurityGroup": true,
+    "@aws-cdk/aws-apigateway:requestValidatorUniqueId": true,
+    "@aws-cdk/aws-kms:aliasNameRef": true,
+    "@aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfig": true,
+    "@aws-cdk/core:includePrefixInUniqueNameGeneration": true,
+    "@aws-cdk/aws-efs:denyAnonymousAccess": true,
+    "@aws-cdk/aws-opensearchservice:enableOpensearchMultiAzWithStandby": true,
+    "@aws-cdk/aws-lambda-nodejs:useLatestRuntimeVersion": true,
+    "@aws-cdk/aws-efs:mountTargetOrderInsensitiveLogicalId": true,
+    "@aws-cdk/aws-rds:auroraClusterChangeScopeOfInstanceParameterGroupWithEachParameters": true,
+    "@aws-cdk/aws-appsync:useArnForSourceApiAssociationIdentifier": true,
+    "@aws-cdk/aws-rds:preventRenderingDeprecatedCredentials": true,
+    "@aws-cdk/aws-codepipeline-actions:useNewDefaultBranchForCodeCommitSource": true,
+    "@aws-cdk/aws-cloudwatch-actions:changeLambdaPermissionLogicalIdForLambdaAction": true,
+    "@aws-cdk/aws-codepipeline:crossAccountKeysDefaultValueToFalse": true,
+    "@aws-cdk/aws-codepipeline:defaultPipelineTypeToV2": true,
+    "@aws-cdk/aws-kms:reduceCrossAccountRegionPolicyScope": true,
+    "@aws-cdk/aws-eks:nodegroupNameAttribute": true,
+    "@aws-cdk/aws-ec2:ebsDefaultGp3Volume": true,
+    "@aws-cdk/aws-ecs:removeDefaultDeploymentAlarm": true,
+    "@aws-cdk/custom-resources:logApiResponseDataPropertyTrueDefault": false,
+    "@aws-cdk/aws-s3:keepNotificationInImportedBucket": false,
+    "@aws-cdk/aws-ecs:enableImdsBlockingDeprecatedFeature": false,
+    "@aws-cdk/aws-ecs:disableEcsImdsBlocking": true,
+    "@aws-cdk/aws-ecs:reduceEc2FargateCloudWatchPermissions": true,
+    "@aws-cdk/aws-dynamodb:resourcePolicyPerReplica": true,
+    "@aws-cdk/aws-ec2:ec2SumTImeoutEnabled": true,
+    "@aws-cdk/aws-appsync:appSyncGraphQLAPIScopeLambdaPermission": true,
+    "@aws-cdk/aws-rds:setCorrectValueForDatabaseInstanceReadReplicaInstanceResourceId": true,
+    "@aws-cdk/core:cfnIncludeRejectComplexResourceUpdateCreatePolicyIntrinsics": true,
+    "@aws-cdk/aws-lambda-nodejs:sdkV3ExcludeSmithyPackages": true,
+    "@aws-cdk/aws-stepfunctions-tasks:fixRunEcsTaskPolicy": true,
+    "@aws-cdk/aws-ec2:bastionHostUseAmazonLinux2023ByDefault": true,
+    "@aws-cdk/aws-route53-targets:userPoolDomainNameMethodWithoutCustomResource": true,
+    "@aws-cdk/aws-elasticloadbalancingV2:albDualstackWithoutPublicIpv4SecurityGroupRulesDefault": true,
+    "@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections": true,
+    "@aws-cdk/core:enableAdditionalMetadataCollection": true,
+    "@aws-cdk/aws-lambda:createNewPoliciesWithAddToRolePolicy": false,
+    "@aws-cdk/aws-s3:setUniqueReplicationRoleName": true,
+    "@aws-cdk/aws-events:requireEventBusPolicySid": true,
+    "@aws-cdk/core:aspectPrioritiesMutating": true,
+    "@aws-cdk/aws-dynamodb:retainTableReplica": true,
+    "@aws-cdk/aws-stepfunctions:useDistributedMapResultWriterV2": true,
+    "@aws-cdk/s3-notifications:addS3TrustKeyPolicyForSnsSubscriptions": true,
+    "@aws-cdk/aws-ec2:requirePrivateSubnetsForEgressOnlyInternetGateway": true,
+    "@aws-cdk/aws-s3:publicAccessBlockedByDefault": true,
+    "@aws-cdk/aws-lambda:useCdkManagedLogGroup": true,
+    "dev": {
+      "Account": "030215556060",
+      "Region": "eu-west-1",
+      "ApplicationName": "Mold Cost Calculator",
+      "ApplicationShortName": "mcc",
+      "Environment": "dev",
+      "Version": "1.0.0",
+      "Parameters": {
+        "VPC": "vpc-02e23456a3e6064f1",
+        "TenantID": "3bfeb222-e42c-4535-aace-ea6f7751369b",
+        "ClientID": "bc56643f-7002-4df9-ada5-1d79f55da6e3"
+      }
+    }
+  }
+}
@@ -0,0 +1,8 @@
+module.exports = {
+  testEnvironment: 'node',
+  roots: ['<rootDir>/test'],
+  testMatch: ['**/*.test.ts'],
+  transform: {
+    '^.+\\.tsx?$': 'ts-jest'
+  }
+};
@@ -0,0 +1,27 @@
+{
+  "name": "infra",
+  "version": "0.1.0",
+  "bin": {
+    "infra": "bin/infra.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "watch": "tsc -w",
+    "test": "jest",
+    "cdk": "cdk"
+  },
+  "devDependencies": {
+    "@types/jest": "^29.5.14",
+    "@types/node": "22.7.9",
+    "aws-cdk": "2.1019.1",
+    "jest": "^29.7.0",
+    "ts-jest": "^29.2.5",
+    "ts-node": "^10.9.2",
+    "typescript": "~5.6.3"
+  },
+  "dependencies": {
+    "@aws-cdk/aws-lambda-python-alpha": "^2.202.0-alpha.0",
+    "aws-cdk-lib": "2.202.0",
+    "constructs": "^10.0.0"
+  }
+}
@@ -0,0 +1,31 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "lib": [
+      "es2022"
+    ],
+    "declaration": true,
+    "strict": true,
+    "noImplicitAny": true,
+    "strictNullChecks": true,
+    "noImplicitThis": true,
+    "alwaysStrict": true,
+    "noUnusedLocals": false,
+    "noUnusedParameters": false,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": false,
+    "inlineSourceMap": true,
+    "inlineSources": true,
+    "experimentalDecorators": true,
+    "strictPropertyInitialization": false,
+    "typeRoots": [
+      "./node_modules/@types"
+    ]
+  },
+  "exclude": [
+    "node_modules",
+    "cdk.out"
+  ]
+}
@@ -0,0 +1,64 @@
+import * as cdk from 'aws-cdk-lib';
+
+interface BuildParameters {
+    readonly VPC: string;
+    readonly TenantID: string;
+    readonly ClientID: string;
+}
+
+interface BuildConfig {
+    readonly Account: string;
+    readonly Region: string;
+    readonly ApplicationName: string;
+    readonly ApplicationShortName: string;
+    readonly Environment: string;
+    readonly Version: string;
+    readonly Parameters: BuildParameters;
+}
+
+const getValidStringValueOfKey = (buildConfig: any, key: string): string => {
+    if (!buildConfig[key] || buildConfig[key].trim().length === 0) {
+        throw new Error(key + ' does not exist or is empty in build config');
+    }
+
+    return buildConfig[key];
+};
+
+const getValidNumberValueOfKey = (buildConfig: any, key: string): number => {
+    if (!buildConfig[key]) {
+        throw new Error(key + ' does not exist or is empty in build config');
+    }
+
+    return buildConfig[key];
+};
+
+const getConfig = (app: cdk.App): BuildConfig => {
+    const env = app.node.tryGetContext('config');
+    if (!env) {
+        throw new Error('Context variable missing on CDK command. Pass in as "-c config=env"');
+    }
+
+    const buildConfig: any = app.node.tryGetContext(env);
+
+    if (!buildConfig) {
+        throw new Error('Wrong Context variable passed on CDK command. Pass in as "-c config=env"');
+    }
+
+    const validBuildConfig: BuildConfig = {
+        Account: getValidStringValueOfKey(buildConfig, 'Account'),
+        Region: getValidStringValueOfKey(buildConfig, 'Region'),
+        Version: getValidStringValueOfKey(buildConfig, 'Version'),
+        ApplicationName: getValidStringValueOfKey(buildConfig, 'ApplicationName'),
+        ApplicationShortName: getValidStringValueOfKey(buildConfig, 'ApplicationShortName'),
+        Environment: getValidStringValueOfKey(buildConfig, 'Environment'),
+        Parameters: {
+            VPC: getValidStringValueOfKey(buildConfig['Parameters'], 'VPC'),
+            TenantID: getValidStringValueOfKey(buildConfig['Parameters'], 'TenantID'),
+            ClientID: getValidStringValueOfKey(buildConfig['Parameters'], 'ClientID')
+        },
+    };
+
+    return validBuildConfig;
+};
+
+export { BuildConfig, BuildParameters, getConfig };