|
| 1 | +/** |
| 2 | + * Copyright 2022 Amazon.com, Inc. or its affiliates. All Rights Reserved. |
| 3 | + * |
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance |
| 5 | + * with the License. A copy of the License is located at |
| 6 | + * |
| 7 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | + * |
| 9 | + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES |
| 10 | + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions |
| 11 | + * and limitations under the License. |
| 12 | + */ |
| 13 | + |
| 14 | +import * as ec2 from "@aws-cdk/aws-ec2"; |
| 15 | +import * as ssm from "@aws-cdk/aws-ssm"; |
| 16 | +// Note: To ensure CDKv2 compatibility, keep the import statement for Construct separate |
| 17 | +import { Construct } from "@aws-cdk/core"; |
| 18 | +import * as defaults from "@aws-solutions-constructs/core"; |
| 19 | +import * as ecs from "@aws-cdk/aws-ecs"; |
| 20 | + |
| 21 | +export interface FargateToSsmstringparameterProps { |
| 22 | + /** |
| 23 | + * Whether the construct is deploying a private or public API. This has implications for the VPC deployed |
| 24 | + * by this construct. |
| 25 | + * |
| 26 | + * @default - none |
| 27 | + */ |
| 28 | + readonly publicApi: boolean; |
| 29 | + /** |
| 30 | + * Optional custom properties for a VPC the construct will create. This VPC will |
| 31 | + * be used by the new Fargate service the construct creates (that's |
| 32 | + * why targetGroupProps can't include a VPC). Providing |
| 33 | + * both this and existingVpc is an error. An SSM Interface |
| 34 | + * endpoint will be included in this VPC. |
| 35 | + * |
| 36 | + * @default - none |
| 37 | + */ |
| 38 | + readonly vpcProps?: ec2.VpcProps; |
| 39 | + /** |
| 40 | + * An existing VPC in which to deploy the construct. Providing both this and |
| 41 | + * vpcProps is an error. If the client provides an existing Fargate service, |
| 42 | + * this value must be the VPC where the service is running. An SSM Interface |
| 43 | + * endpoint will be added to this VPC. |
| 44 | + * |
| 45 | + * @default - none |
| 46 | + */ |
| 47 | + readonly existingVpc?: ec2.IVpc; |
| 48 | + /** |
| 49 | + * Optional properties to create a new ECS cluster |
| 50 | + */ |
| 51 | + readonly clusterProps?: ecs.ClusterProps; |
| 52 | + /** |
| 53 | + * The arn of an ECR Repository containing the image to use |
| 54 | + * to generate the containers |
| 55 | + * |
| 56 | + * format: |
| 57 | + * arn:aws:ecr:[region]:[account number]:repository/[Repository Name] |
| 58 | + */ |
| 59 | + readonly ecrRepositoryArn?: string; |
| 60 | + /** |
| 61 | + * The version of the image to use from the repository |
| 62 | + * |
| 63 | + * @default - 'latest' |
| 64 | + */ |
| 65 | + readonly ecrImageVersion?: string; |
| 66 | + /* |
| 67 | + * Optional props to define the container created for the Fargate Service |
| 68 | + * |
| 69 | + * defaults - fargate-defaults.ts |
| 70 | + */ |
| 71 | + readonly containerDefinitionProps?: ecs.ContainerDefinitionProps | any; |
| 72 | + /* |
| 73 | + * Optional props to define the Fargate Task Definition for this construct |
| 74 | + * |
| 75 | + * defaults - fargate-defaults.ts |
| 76 | + */ |
| 77 | + readonly fargateTaskDefinitionProps?: ecs.FargateTaskDefinitionProps | any; |
| 78 | + /** |
| 79 | + * Optional values to override default Fargate Task definition properties |
| 80 | + * (fargate-defaults.ts). The construct will default to launching the service |
| 81 | + * is the most isolated subnets available (precedence: Isolated, Private and |
| 82 | + * Public). Override those and other defaults here. |
| 83 | + * |
| 84 | + * defaults - fargate-defaults.ts |
| 85 | + */ |
| 86 | + readonly fargateServiceProps?: ecs.FargateServiceProps | any; |
| 87 | + /** |
| 88 | + * A Fargate Service already instantiated (probably by another Solutions Construct). If |
| 89 | + * this is specified, then no props defining a new service can be provided, including: |
| 90 | + * existingImageObject, ecrImageVersion, containerDefintionProps, fargateTaskDefinitionProps, |
| 91 | + * ecrRepositoryArn, fargateServiceProps, clusterProps, existingClusterInterface. If this value |
| 92 | + * is provided, then existingContainerDefinitionObject must be provided as well. |
| 93 | + * |
| 94 | + * @default - none |
| 95 | + */ |
| 96 | + readonly existingFargateServiceObject?: ecs.FargateService; |
| 97 | + /* |
| 98 | + * A container definition already instantiated as part of a Fargate service. This must |
| 99 | + * be the container in the existingFargateServiceObject. |
| 100 | + * |
| 101 | + * @default - None |
| 102 | + */ |
| 103 | + readonly existingContainerDefinitionObject?: ecs.ContainerDefinition; |
| 104 | + /** |
| 105 | + * Optional user provided props to override the default props for SSM String Parameter. |
| 106 | + * |
| 107 | + * @default - Default props are used |
| 108 | + */ |
| 109 | + readonly stringParameterProps?: ssm.StringParameterProps; |
| 110 | + /** |
| 111 | + * Optional user provided props to override the default props for SSM String Parameter. |
| 112 | + * |
| 113 | + * @default - None |
| 114 | + */ |
| 115 | + readonly existingStringParameterObj?: ssm.StringParameter; |
| 116 | + /** |
| 117 | + * Optional SSM String parameter permissions to grant to the Fargate service. One of the following may be specified: "Read", "ReadWrite". |
| 118 | + * |
| 119 | + * @default - 'ReadWrite' |
| 120 | + */ |
| 121 | + readonly stringParameterPermissions?: string |
| 122 | + /** |
| 123 | + * Optional Name for the SSM parameter name environment variable set for the container. |
| 124 | + * |
| 125 | + * @default - None |
| 126 | + */ |
| 127 | + readonly stringParameterEnvironmentVariableName?: string; |
| 128 | +} |
| 129 | + |
| 130 | +export class FargateToSsmstringparameter extends Construct { |
| 131 | + public readonly vpc: ec2.IVpc; |
| 132 | + public readonly service: ecs.FargateService; |
| 133 | + public readonly container: ecs.ContainerDefinition; |
| 134 | + public readonly stringParameter: ssm.StringParameter; |
| 135 | + |
| 136 | + constructor(scope: Construct, id: string, props: FargateToSsmstringparameterProps) { |
| 137 | + super(scope, id); |
| 138 | + defaults.CheckProps(props); |
| 139 | + defaults.CheckFargateProps(props); |
| 140 | + |
| 141 | + // Other permissions for constructs are accepted as arrays, turning stringParameterPermissions into |
| 142 | + // an array to use the same validation function. |
| 143 | + if (props.stringParameterPermissions) { |
| 144 | + const allowedPermissions = ['READ', 'READWRITE']; |
| 145 | + defaults.CheckListValues(allowedPermissions, [props.stringParameterPermissions.toUpperCase()], 'stringParameterPermissions'); |
| 146 | + } |
| 147 | + |
| 148 | + this.vpc = defaults.buildVpc(scope, { |
| 149 | + existingVpc: props.existingVpc, |
| 150 | + defaultVpcProps: props.publicApi ? defaults.DefaultPublicPrivateVpcProps() : defaults.DefaultIsolatedVpcProps(), |
| 151 | + userVpcProps: props.vpcProps, |
| 152 | + constructVpcProps: { enableDnsHostnames: true, enableDnsSupport: true } |
| 153 | + }); |
| 154 | + |
| 155 | + defaults.AddAwsServiceEndpoint(scope, this.vpc, defaults.ServiceEndpointTypes.SSM); |
| 156 | + |
| 157 | + if (props.existingFargateServiceObject) { |
| 158 | + this.service = props.existingFargateServiceObject; |
| 159 | + // CheckFargateProps confirms that the container is provided |
| 160 | + this.container = props.existingContainerDefinitionObject!; |
| 161 | + } else { |
| 162 | + [this.service, this.container] = defaults.CreateFargateService( |
| 163 | + scope, |
| 164 | + id, |
| 165 | + this.vpc, |
| 166 | + props.clusterProps, |
| 167 | + props.ecrRepositoryArn, |
| 168 | + props.ecrImageVersion, |
| 169 | + props.fargateTaskDefinitionProps, |
| 170 | + props.containerDefinitionProps, |
| 171 | + props.fargateServiceProps |
| 172 | + ); |
| 173 | + } |
| 174 | + |
| 175 | + // Setup the SSM String parameter |
| 176 | + if (props.existingStringParameterObj) { |
| 177 | + this.stringParameter = props.existingStringParameterObj; |
| 178 | + } else { |
| 179 | + if (!props.stringParameterProps) { |
| 180 | + throw new Error("existingStringParameterObj or stringParameterProps needs to be provided."); |
| 181 | + } |
| 182 | + this.stringParameter = defaults.buildSsmStringParameter(this, 'stringParameter', props.stringParameterProps); |
| 183 | + } |
| 184 | + |
| 185 | + // Add the requested or default string parameter permissions |
| 186 | + this.stringParameter.grantRead(this.service.taskDefinition.taskRole); |
| 187 | + if (props.stringParameterPermissions) { |
| 188 | + const _permissions = props.stringParameterPermissions.toUpperCase(); |
| 189 | + |
| 190 | + if (_permissions === 'READWRITE') { |
| 191 | + this.stringParameter.grantWrite(this.service.taskDefinition.taskRole); |
| 192 | + } |
| 193 | + } |
| 194 | + |
| 195 | + // Add environment variables |
| 196 | + const stringParameterEnvironmentVariableName = props.stringParameterEnvironmentVariableName || 'SSM_STRING_PARAMETER_NAME'; |
| 197 | + this.container.addEnvironment(stringParameterEnvironmentVariableName, this.stringParameter.parameterName); |
| 198 | + } |
| 199 | +} |
0 commit comments