|
| 1 | +/** |
| 2 | + * Copyright 2022 Amazon.com, Inc. or its affiliates. All Rights Reserved. |
| 3 | + * |
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance |
| 5 | + * with the License. A copy of the License is located at |
| 6 | + * |
| 7 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | + * |
| 9 | + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES |
| 10 | + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions |
| 11 | + * and limitations under the License. |
| 12 | + */ |
| 13 | + |
| 14 | +import * as ec2 from "@aws-cdk/aws-ec2"; |
| 15 | +import * as s3 from "@aws-cdk/aws-s3"; |
| 16 | +// Note: To ensure CDKv2 compatibility, keep the import statement for Construct separate |
| 17 | +import { Construct } from "@aws-cdk/core"; |
| 18 | +import * as defaults from "@aws-solutions-constructs/core"; |
| 19 | +import * as ecs from "@aws-cdk/aws-ecs"; |
| 20 | + |
| 21 | +export interface FargateToS3Props { |
| 22 | + /** |
| 23 | + * Optional custom properties for a VPC the construct will create. This VPC will |
| 24 | + * be used by the new Fargate service the construct creates (that's |
| 25 | + * why targetGroupProps can't include a VPC). Providing |
| 26 | + * both this and existingVpc is an error. An S3 Interface |
| 27 | + * endpoint will be included in this VPC. |
| 28 | + * |
| 29 | + * @default - none |
| 30 | + */ |
| 31 | + readonly vpcProps?: ec2.VpcProps; |
| 32 | + /** |
| 33 | + * An existing VPC in which to deploy the construct. Providing both this and |
| 34 | + * vpcProps is an error. If the client provides an existing Fargate service, |
| 35 | + * this value must be the VPC where the service is running. An S3 Interface |
| 36 | + * endpoint will be added to this VPC. |
| 37 | + * |
| 38 | + * @default - none |
| 39 | + */ |
| 40 | + readonly existingVpc?: ec2.IVpc; |
| 41 | + /** |
| 42 | + * Whether the construct is deploying a private or public API. This has implications for the VPC deployed |
| 43 | + * by this construct. |
| 44 | + * |
| 45 | + * @default - none |
| 46 | + */ |
| 47 | + readonly publicApi: boolean; |
| 48 | + /** |
| 49 | + * Optional properties to create a new ECS cluster |
| 50 | + */ |
| 51 | + readonly clusterProps?: ecs.ClusterProps; |
| 52 | + /** |
| 53 | + * The arn of an ECR Repository containing the image to use |
| 54 | + * to generate the containers |
| 55 | + * |
| 56 | + * format: |
| 57 | + * arn:aws:ecr:[region]:[account number]:repository/[Repository Name] |
| 58 | + */ |
| 59 | + readonly ecrRepositoryArn?: string; |
| 60 | + /** |
| 61 | + * The version of the image to use from the repository |
| 62 | + * |
| 63 | + * @default - 'latest' |
| 64 | + */ |
| 65 | + readonly ecrImageVersion?: string; |
| 66 | + /* |
| 67 | + * Optional props to define the container created for the Fargate Service |
| 68 | + * |
| 69 | + * defaults - fargate-defaults.ts |
| 70 | + */ |
| 71 | + readonly containerDefinitionProps?: ecs.ContainerDefinitionProps | any; |
| 72 | + /* |
| 73 | + * Optional props to define the Fargate Task Definition for this construct |
| 74 | + * |
| 75 | + * defaults - fargate-defaults.ts |
| 76 | + */ |
| 77 | + readonly fargateTaskDefinitionProps?: ecs.FargateTaskDefinitionProps | any; |
| 78 | + /** |
| 79 | + * Optional values to override default Fargate Task definition properties |
| 80 | + * (fargate-defaults.ts). The construct will default to launching the service |
| 81 | + * is the most isolated subnets available (precedence: Isolated, Private and |
| 82 | + * Public). Override those and other defaults here. |
| 83 | + * |
| 84 | + * defaults - fargate-defaults.ts |
| 85 | + */ |
| 86 | + readonly fargateServiceProps?: ecs.FargateServiceProps | any; |
| 87 | + /** |
| 88 | + * A Fargate Service already instantiated (probably by another Solutions Construct). If |
| 89 | + * this is specified, then no props defining a new service can be provided, including: |
| 90 | + * existingImageObject, ecrImageVersion, containerDefintionProps, fargateTaskDefinitionProps, |
| 91 | + * ecrRepositoryArn, fargateServiceProps, clusterProps, existingClusterInterface. If this value |
| 92 | + * is provided, then existingContainerDefinitionObject must be provided as well. |
| 93 | + * |
| 94 | + * @default - none |
| 95 | + */ |
| 96 | + readonly existingFargateServiceObject?: ecs.FargateService; |
| 97 | + /** |
| 98 | + * Existing instance of S3 Bucket object, providing both this and `bucketProps` will cause an error. |
| 99 | + * |
| 100 | + * @default - None |
| 101 | + */ |
| 102 | + readonly existingBucketObj?: s3.IBucket; |
| 103 | + /** |
| 104 | + * Optional user provided props to override the default props for the S3 Bucket. |
| 105 | + * |
| 106 | + * @default - Default props are used |
| 107 | + */ |
| 108 | + readonly bucketProps?: s3.BucketProps; |
| 109 | + /** |
| 110 | + * Optional user provided props to override the default props for the S3 Logging Bucket. |
| 111 | + * |
| 112 | + * @default - Default props are used |
| 113 | + */ |
| 114 | + readonly loggingBucketProps?: s3.BucketProps |
| 115 | + /** |
| 116 | + * Whether to turn on Access Logs for the S3 bucket with the associated storage costs. |
| 117 | + * Enabling Access Logging is a best practice. |
| 118 | + * |
| 119 | + * @default - true |
| 120 | + */ |
| 121 | + readonly logS3AccessLogs?: boolean; |
| 122 | + /** |
| 123 | + * Optional bucket permissions to grant to the Lambda function. |
| 124 | + * One or more of the following may be specified: "Delete", "Put", "Read", "ReadWrite", "Write". |
| 125 | + * |
| 126 | + * @default - Read/write access is given to the Lambda function if no value is specified. |
| 127 | + */ |
| 128 | + readonly bucketPermissions?: string[]; |
| 129 | + /** |
| 130 | + * Optional Name for the S3 bucket arn environment variable set for the container. |
| 131 | + * |
| 132 | + * @default - None |
| 133 | + */ |
| 134 | + readonly bucketArnEnvironmentVariableName?: string; |
| 135 | + /** |
| 136 | + * Optional Name for the S3 bucket name environment variable set for the container. |
| 137 | + * |
| 138 | + * @default - None |
| 139 | + */ |
| 140 | + readonly bucketEnvironmentVariableName?: string; |
| 141 | + /* |
| 142 | + * A container definition already instantiated as part of a Fargate service. This must |
| 143 | + * be the container in the existingFargateServiceObject. |
| 144 | + * |
| 145 | + * @default - None |
| 146 | + */ |
| 147 | + readonly existingContainerDefinitionObject?: ecs.ContainerDefinition; |
| 148 | +} |
| 149 | + |
| 150 | +export class FargateToS3 extends Construct { |
| 151 | + public readonly vpc: ec2.IVpc; |
| 152 | + public readonly service: ecs.FargateService; |
| 153 | + public readonly container: ecs.ContainerDefinition; |
| 154 | + public readonly s3BucketInterface: s3.IBucket; |
| 155 | + public readonly s3Bucket?: s3.Bucket; |
| 156 | + public readonly s3LoggingBucket?: s3.Bucket; |
| 157 | + |
| 158 | + constructor(scope: Construct, id: string, props: FargateToS3Props) { |
| 159 | + super(scope, id); |
| 160 | + defaults.CheckProps(props); |
| 161 | + defaults.CheckFargateProps(props); |
| 162 | + |
| 163 | + this.vpc = defaults.buildVpc(scope, { |
| 164 | + existingVpc: props.existingVpc, |
| 165 | + defaultVpcProps: props.publicApi ? defaults.DefaultPublicPrivateVpcProps() : defaults.DefaultIsolatedVpcProps(), |
| 166 | + userVpcProps: props.vpcProps, |
| 167 | + constructVpcProps: { enableDnsHostnames: true, enableDnsSupport: true } |
| 168 | + }); |
| 169 | + |
| 170 | + defaults.AddAwsServiceEndpoint(scope, this.vpc, defaults.ServiceEndpointTypes.S3); |
| 171 | + |
| 172 | + if (props.existingFargateServiceObject) { |
| 173 | + this.service = props.existingFargateServiceObject; |
| 174 | + // CheckFargateProps confirms that the container is provided |
| 175 | + this.container = props.existingContainerDefinitionObject!; |
| 176 | + } else { |
| 177 | + [this.service, this.container] = defaults.CreateFargateService( |
| 178 | + scope, |
| 179 | + id, |
| 180 | + this.vpc, |
| 181 | + props.clusterProps, |
| 182 | + props.ecrRepositoryArn, |
| 183 | + props.ecrImageVersion, |
| 184 | + props.fargateTaskDefinitionProps, |
| 185 | + props.containerDefinitionProps, |
| 186 | + props.fargateServiceProps |
| 187 | + ); |
| 188 | + } |
| 189 | + |
| 190 | + // Setup the S3 Bucket |
| 191 | + let bucket: s3.IBucket; |
| 192 | + |
| 193 | + if (!props.existingBucketObj) { |
| 194 | + [this.s3Bucket, this.s3LoggingBucket] = defaults.buildS3Bucket(this, { |
| 195 | + bucketProps: props.bucketProps, |
| 196 | + loggingBucketProps: props.loggingBucketProps, |
| 197 | + logS3AccessLogs: props.logS3AccessLogs |
| 198 | + }); |
| 199 | + bucket = this.s3Bucket; |
| 200 | + } else { |
| 201 | + bucket = props.existingBucketObj; |
| 202 | + } |
| 203 | + |
| 204 | + this.s3BucketInterface = bucket; |
| 205 | + |
| 206 | + // Add the requested or default bucket permissions |
| 207 | + if (props.bucketPermissions) { |
| 208 | + if (props.bucketPermissions.includes('Delete')) { |
| 209 | + bucket.grantDelete(this.service.taskDefinition.taskRole); |
| 210 | + } |
| 211 | + if (props.bucketPermissions.includes('Put')) { |
| 212 | + bucket.grantPut(this.service.taskDefinition.taskRole); |
| 213 | + } |
| 214 | + if (props.bucketPermissions.includes('Read')) { |
| 215 | + bucket.grantRead(this.service.taskDefinition.taskRole); |
| 216 | + } |
| 217 | + if (props.bucketPermissions.includes('ReadWrite')) { |
| 218 | + bucket.grantReadWrite(this.service.taskDefinition.taskRole); |
| 219 | + } |
| 220 | + if (props.bucketPermissions.includes('Write')) { |
| 221 | + bucket.grantWrite(this.service.taskDefinition.taskRole); |
| 222 | + } |
| 223 | + } else { |
| 224 | + bucket.grantReadWrite(this.service.taskDefinition.taskRole); |
| 225 | + } |
| 226 | + |
| 227 | + // Add environment variables |
| 228 | + const bucketArnEnvironmentVariableName = props.bucketArnEnvironmentVariableName || 'S3_BUCKET_ARN'; |
| 229 | + this.container.addEnvironment(bucketArnEnvironmentVariableName, this.s3BucketInterface.bucketArn); |
| 230 | + const bucketEnvironmentVariableName = props.bucketEnvironmentVariableName || 'S3_BUCKET_NAME'; |
| 231 | + this.container.addEnvironment(bucketEnvironmentVariableName, this.s3BucketInterface.bucketName); |
| 232 | + |
| 233 | + } |
| 234 | +} |
0 commit comments