Initial jenkins version

infra/bin/apiStack.ts

@@ -0,0 +1,99 @@
+import {
+    Stack,
+    StackProps,
+    aws_apigateway as apigateway,
+    aws_lambda,
+    aws_ec2,
+    Duration,
+} from 'aws-cdk-lib';
+import * as aws_lambda_python_alpha from '@aws-cdk/aws-lambda-python-alpha';
+import { Construct } from 'constructs';
+import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
+import { join } from 'path';
+import { Runtime } from 'aws-cdk-lib/aws-lambda';
+import { BuildConfig } from '../utils/build-config';
+import { Period } from 'aws-cdk-lib/aws-apigateway';
+import { RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { VpcEndpoint, VpcEndpointService } from 'aws-cdk-lib/aws-ec2';
+import { PolicyStatement, PolicyDocument, Effect, AnyPrincipal } from 'aws-cdk-lib/aws-iam';
+
+
+export class MccAPIInfraStack extends Stack {
+    public readonly api: apigateway.RestApi;
+
+    constructor(
+        scope: Construct,
+        id: string,
+        buildConfig: BuildConfig,
+        props: StackProps,
+    ) {
+        super(scope, id, props);
+
+        const stackName = `${buildConfig.Environment}${buildConfig.ApplicationShortName}`;
+
+        const vpc = aws_ec2.Vpc.fromLookup(this, `${stackName}Vpc`, {
+            vpcId: buildConfig.Parameters.VPC,
+        });
+
+        const executeApiVpcEndpointSecurityGroup = new aws_ec2.SecurityGroup(this, `${stackName}ExecuteApiVPCEsg`, {
+            vpc,
+            description: 'Security group for API Gateway VPC Endpoint',
+            allowAllOutbound: true,
+        });
+
+        executeApiVpcEndpointSecurityGroup.addIngressRule(
+            aws_ec2.Peer.ipv4('10.0.0.0/8'),
+            aws_ec2.Port.tcp(443),
+            'Allow inbound HTTPS traffic from 10.0.0.0/8'
+        );
+
+        const executeApiVpcEndpoint = new aws_ec2.InterfaceVpcEndpoint(this, `${stackName}ExecuteApiVPCE`, {
+            vpc,
+            service: aws_ec2.InterfaceVpcEndpointAwsService.APIGATEWAY,
+            privateDnsEnabled: true,
+            subnets: { subnetType: aws_ec2.SubnetType.PRIVATE_WITH_EGRESS },
+            securityGroups: [executeApiVpcEndpointSecurityGroup]
+        });
+
+        const lambdaFunction = new aws_lambda_python_alpha.PythonFunction(this, `${stackName}MCCApp`, {
+            runtime: Runtime.PYTHON_3_11,
+            handler: 'lambda_handler',
+            timeout: Duration.seconds(30),
+            entry: join(__dirname, '../../src'),
+            index: 'run.py',
+            memorySize: 256,
+            vpc,
+            logRetention: RetentionDays.ONE_WEEK,
+        });
+
+        const api = new apigateway.LambdaRestApi(this, `${stackName}MCCAPI`, {
+            handler: lambdaFunction,
+            proxy: true,
+            deployOptions: {
+                stageName: buildConfig.Environment,
+            },
+            restApiName: `${buildConfig.ApplicationName} API`,
+            description: `API for ${buildConfig.ApplicationName} in ${buildConfig.Environment}`,
+            endpointConfiguration: {
+                types: [apigateway.EndpointType.PRIVATE],
+                vpcEndpoints: [executeApiVpcEndpoint],
+            },
+            policy: new PolicyDocument({
+                statements: [
+                    new PolicyStatement({
+                        effect: Effect.ALLOW,
+                        principals: [new AnyPrincipal()],
+                        actions: ['execute-api:Invoke'],
+                        resources: ['execute-api:/*'],
+                        // Optionally, restrict by source VPC or VPC endpoint
+                        conditions: {
+                             StringEquals: { 'aws:SourceVpce': executeApiVpcEndpoint.vpcEndpointId }
+                         }
+                    }),
+                ],
+            }),
+        });
+
+        this.api = api;
+    }
+}

infra/bin/infra.ts

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import * as cdk from 'aws-cdk-lib';
+import { getConfig, BuildConfig } from '../utils/build-config';
+import { MccAPIInfraStack } from './apiStack';
+import { MccDBInfraStack } from './rdsStack';
+
+const app = new cdk.App();
+const buildConfig: BuildConfig = getConfig(app);
+
+const qualifier = process.env.CDK_QUALIFIER;
+
+const stackName = `${buildConfig.Environment}${buildConfig.ApplicationShortName}`;
+
+cdk.Tags.of(app).add('App', buildConfig.ApplicationName);
+cdk.Tags.of(app).add('Environment', buildConfig.Environment);
+cdk.Tags.of(app).add('AppManagerCFNStackKey', stackName);
+cdk.Tags.of(app).add('purpose', `${buildConfig.Environment}-${buildConfig.ApplicationShortName}`);
+
+const env: cdk.Environment = {
+  account: buildConfig.Account ?? process.env.CDK_DEPLOY_ACCOUNT ?? process.env.CDK_DEFAULT_ACCOUNT,
+  region: buildConfig.Region ?? process.env.CDK_DEPLOY_REGION ?? process.env.CDK_DEFAULT_REGION,
+};
+
+const apiStack = new MccAPIInfraStack(app, `${stackName}MCCAPI`, buildConfig, {
+  env,
+  description: `API stack for ${buildConfig.ApplicationName} in ${buildConfig.Environment}`,
+  synthesizer: new cdk.DefaultStackSynthesizer({
+    qualifier,
+  }),
+});
+
+const dbStack = new MccDBInfraStack(app, `${stackName}MCCDB`, buildConfig, {
+  env,
+  description: `Database stack for ${buildConfig.ApplicationName} in ${buildConfig.Environment}`,
+  synthesizer: new cdk.DefaultStackSynthesizer({
+    qualifier,
+  }),
+});
+

infra/bin/rdsStack.ts

@@ -0,0 +1,79 @@
+import {
+  Stack,
+  aws_ec2 as ec2,
+  aws_rds as rds,
+  StackProps,
+  RemovalPolicy,
+} from 'aws-cdk-lib';
+import { Port } from 'aws-cdk-lib/aws-ec2';
+import { Construct } from 'constructs';
+import { BuildConfig } from '../utils/build-config';
+import { ClusterInstance } from 'aws-cdk-lib/aws-rds';
+
+export class MccDBInfraStack extends Stack {
+  public readonly mccDB: rds.DatabaseCluster;
+  public readonly mccDBSecurityGroup: ec2.SecurityGroup;
+
+  credentials = rds.Credentials.fromGeneratedSecret('mccAdmin');
+
+  constructor(scope: Construct, id: string, buildConfig: BuildConfig, props: StackProps) {
+    super(scope, id, props);
+
+    const vpc = ec2.Vpc.fromLookup(
+      this,
+      `${buildConfig.Environment}-${buildConfig.ApplicationShortName}MccVPC`,
+      {
+        vpcId: buildConfig.Parameters.VPC,
+      }
+    );
+
+    const dbSecurityGroup = new ec2.SecurityGroup(
+      this,
+      `${buildConfig.Environment}${buildConfig.ApplicationShortName}MccDBSecurityGroup`,
+      {
+        vpc: vpc,
+        securityGroupName: `${buildConfig.Environment}-${buildConfig.ApplicationShortName}DBSecurityGroup`,
+      }
+    );
+
+    const mccDB = new rds.DatabaseCluster(this, `${buildConfig.Environment}${buildConfig.ApplicationShortName}MccDB`, {
+        engine: rds.DatabaseClusterEngine.auroraPostgres({
+            version: rds.AuroraPostgresEngineVersion.VER_17_4,
+            }) ,
+        vpc,
+        writer: ClusterInstance.serverlessV2('writer') ,
+        credentials: this.credentials,
+        defaultDatabaseName: 'mccdb',
+        securityGroups: [dbSecurityGroup],
+        serverlessV2MinCapacity: 0,
+        serverlessV2MaxCapacity: 64,
+        enableDataApi: true,
+        clusterIdentifier: `${buildConfig.Environment}-${buildConfig.ApplicationShortName}-mccdb`,
+        removalPolicy: RemovalPolicy.RETAIN
+    });
+
+    const lambdaSecurityGroup = new ec2.SecurityGroup(
+      this,
+      `${buildConfig.Environment}${buildConfig.ApplicationShortName}MccDBLambdaSecurityGroup`,
+      {
+        vpc: vpc,
+        securityGroupName: `${buildConfig.Environment}-${buildConfig.ApplicationShortName}DBLambdaSecurityGroup`,
+      }
+    );
+
+    dbSecurityGroup.addIngressRule(
+      lambdaSecurityGroup,
+      Port.tcp(mccDB.clusterEndpoint.port),
+      'Allow connection from Lambda Function to DB'
+    );
+
+    dbSecurityGroup.addIngressRule(
+      ec2.Peer.ipv4('10.0.0.0/8'),
+      Port.tcp(mccDB.clusterEndpoint.port),
+      'Allow connection from internal network'
+    );
+
+    this.mccDB = mccDB;
+    this.mccDBSecurityGroup = lambdaSecurityGroup;
+  }
+}