diff --git a/.viperlightignore b/.viperlightignore index 1812d6097..6604c2705 100644 --- a/.viperlightignore +++ b/.viperlightignore @@ -140,4 +140,8 @@ source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/integ.depl source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/integ.existingEventBus.expected.json:108 source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/integ.existingFunction.expected.json:122 source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/aws-lambda-eventbridge.test.ts:28 -source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/aws-lambda-eventbridge.test.ts:339 \ No newline at end of file +source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/aws-lambda-eventbridge.test.ts:339 +# These are references to the us-east-1 ELBV2 account (publicly known) +source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.expected.json:193 +source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.expected.json:844 +source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json:188 diff --git a/package-lock.json b/package-lock.json new file mode 100644 index 000000000..56d8b5a65 --- /dev/null +++ b/package-lock.json @@ -0,0 +1,34 @@ +{ + "requires": true, + "lockfileVersion": 1, + "dependencies": { + "eslint-plugin-mocha": { + "version": "9.0.0", + "resolved": "https://registry.npmjs.org/eslint-plugin-mocha/-/eslint-plugin-mocha-9.0.0.tgz", + "integrity": "sha512-d7knAcQj1jPCzZf3caeBIn3BnW6ikcvfz0kSqQpwPYcVGLoJV5sz0l0OJB2LR8I7dvTDbqq1oV6ylhSgzA10zg==", + "dev": true, + "requires": { + "eslint-utils": "^3.0.0", + "ramda": "^0.27.1" + } + }, + "eslint-utils": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/eslint-utils/-/eslint-utils-3.0.0.tgz", + "integrity": "sha512-uuQC43IGctw68pJA1RgbQS8/NP7rch6Cwd4j3ZBtgo4/8Flj4eGE7ZYSZRN3iq5pVUv6GPdW5Z1RFleo84uLDA==", + "requires": { + "eslint-visitor-keys": "^2.0.0" + } + }, + "eslint-visitor-keys": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-2.1.0.tgz", + "integrity": "sha512-0rSmRBzXgDzIsD6mGdJgevzgezI534Cer5L/vyMX0kHzT/jiB43jRhd9YUlMGYLQy2zprNmoT8qasCGtY+QaKw==" + }, + "ramda": { + "version": "0.27.1", + "resolved": "https://registry.npmjs.org/ramda/-/ramda-0.27.1.tgz", + "integrity": "sha512-PgIdVpn5y5Yns8vqb8FzBUEYn98V3xcPgawAkkgj0YJ0qDsnHCiNmZYfOGMgOvoB0eWFLpYbhxUR3mxfDIMvpw==" + } + } +} diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/.eslintignore b/source/patterns/@aws-solutions-constructs/aws-route53-alb/.eslintignore new file mode 100644 index 000000000..e6f7801ea --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/.eslintignore @@ -0,0 +1,4 @@ +lib/*.js +test/*.js +*.d.ts +coverage diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/.gitignore b/source/patterns/@aws-solutions-constructs/aws-route53-alb/.gitignore new file mode 100644 index 000000000..6773cabd2 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/.gitignore @@ -0,0 +1,15 @@ +lib/*.js +test/*.js +*.js.map +*.d.ts +node_modules +*.generated.ts +dist +.jsii + +.LAST_BUILD +.nyc_output +coverage +.nycrc +.LAST_PACKAGE +*.snk \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/.npmignore b/source/patterns/@aws-solutions-constructs/aws-route53-alb/.npmignore new file mode 100644 index 000000000..f66791629 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/.npmignore @@ -0,0 +1,21 @@ +# Exclude typescript source and config +*.ts +tsconfig.json +coverage +.nyc_output +*.tgz +*.snk +*.tsbuildinfo + +# Include javascript files and typescript declarations +!*.js +!*.d.ts + +# Exclude jsii outdir +dist + +# Include .jsii +!.jsii + +# Include .jsii +!.jsii \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/README.md b/source/patterns/@aws-solutions-constructs/aws-route53-alb/README.md new file mode 100644 index 000000000..607ad807d --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/README.md @@ -0,0 +1,95 @@ +# aws-route53-alb module + + +--- + +![Stability: Experimental](https://img.shields.io/badge/stability-Experimental-important.svg?style=for-the-badge) + +> All classes are under active development and subject to non-backward compatible changes or removal in any +> future version. These are not subject to the [Semantic Versioning](https://semver.org/) model. +> This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package. + +--- + + +| **Reference Documentation**:| https://docs.aws.amazon.com/solutions/latest/constructs/| +|:-------------|:-------------| +
+ +| **Language** | **Package** | +|:-------------|-----------------| +|![Python Logo](https://docs.aws.amazon.com/cdk/api/latest/img/python32.png) Python|`aws_solutions_constructs.aws_route53_alb`| +|![Typescript Logo](https://docs.aws.amazon.com/cdk/api/latest/img/typescript32.png) Typescript|`@aws-solutions-constructs/aws-route53-alb`| +|![Java Logo](https://docs.aws.amazon.com/cdk/api/latest/img/java32.png) Java|`software.amazon.awsconstructs.services.route53alb`| + +This AWS Solutions Construct implements an Amazon Route53 Hosted Zone routing to an Application Load Balancer + +Here is a minimal deployable pattern definition in Typescript: + +``` typescript +import { Route53ToAlb } from '@aws-solutions-constructs/aws-route53-alb'; + +new Route53ToAlb(this, 'Route53ToAlbPattern', { + privateHostedZoneProps: { + zoneName: 'www.example.com', + } + publicApi: false, +}); + +``` + +## Initializer + +``` text +new Route53ToAlb(scope: Construct, id: string, props: Route53ToAlbProps); +``` + +_Parameters_ + +* scope [`Construct`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_core.Construct.html) +* id `string` +* props [`Route53ToAlbProps`](#pattern-construct-props) + +## Pattern Construct Props + +This construct cannot create a new Public Hosted Zone, if you are creating a public API you must supply an existing Public Hosted Zone that will be reconfigured with a new Alias record. Public Hosted Zones are configured with public domain names and are not well suited to be launched and torn down dynamically, so this construct will only reconfigure existing Public Hosted Zones. + +This construct can create Private Hosted Zones. If you want a Private Hosted Zone, then you can either provide an existing Private Hosted Zone or a privateHostedZoneProps value with at least the Domain Name defined. + +| **Name** | **Type** | **Description** | +|:-------------|:----------------|-----------------| +| privateHostedZoneProps? | [route53.PrivateHostedZoneProps](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-route53.PrivateHostedZoneProps.html) | Optional custom properties for a new Private Hosted Zone. Cannot be specified for a public API. Cannot specify a VPC, it will use the VPC in existingVpc or the VPC created by the construct. Providing both this and existingHostedZoneInterfaceis an error. | +| existingHostedZoneInterface? | [route53.IHostedZone](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-route53.IHostedZone.html) | Existing Public or Private Hosted Zone (type must match publicApi setting). Specifying both this and privateHostedZoneProps is an error. If this is a Private Hosted Zone, the associated VPC must be provided as the existingVpc property | +| loadBalancerProps? | [elasticloadbalancingv2.ApplicationLoadBalancerProps](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancerProps.html) | Optional custom properties for a new loadBalancer. Providing both this and existingLoadBalancer is an error. This cannot specify a VPC, it will use the VPC in existingVpc or the VPC created by the construct. | +| existingLoadBalancerObj? | [elasticloadbalancingv2.ApplicationLoadBalancer](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html) | Existing Application Load Balancer to incorporate into the construct architecture. Providing both this and loadBalancerProps is an error. The VPC containing this loadBalancer must match the VPC provided in existingVpc. | +| vpcProps? | [ec2.VpcProps](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-ec2.VpcProps.html) | Optional custom properties for a VPC the construct will create. This VPC will be used by the new ALB and any Private Hosted Zone the construct creates (that's why loadBalancerProps and privateHostedZoneProps can't include a VPC). Providing both this and existingVpc is an error. | +| existingVpc? | [ec2.IVpc](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-ec2.IVpc.html) | An existing VPC in which to deploy the construct. Providing both this and vpcProps is an error. If the client provides an existing load balancer and/or existing Private Hosted Zone, those constructs must exist in this VPC. | +| logAccessLogs? | boolean| Whether to turn on Access Logs for the Application Load Balancer. Uses an S3 bucket with associated storage costs.Enabling Access Logging is a best practice. default - true | +| loggingBucketProps? | [s3.BucketProps](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-s3.BucketProps.html) | Optional properties to customize the bucket used to store the ALB Access Logs. Supplying this and setting logAccessLogs to false is an error. @default - none | + +| publicApi | boolean | Whether the construct is deploying a private or public API. This has implications for the Hosted Zone, VPC and ALB. | + + +## Pattern Properties + +| **Name** | **Type** | **Description** | +|:-------------|:----------------|-----------------| +| hostedZone | [route53.IHostedZone](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-route53.IHostedZone.html) | The hosted zone used by the construct (whether created by the construct or providedb by the client) | +| vpc | [ec2.IVpc](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-ec2.IVpc.html) | The VPC used by the construct (whether created by the construct or providedb by the client) | +| loadBalancer | [elasticloadbalancingv2.ApplicationLoadBalancer](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html) | The Load Balancer used by the construct (whether created by the construct or providedb by the client) | + +## Default settings + +Out of the box implementation of the Construct without any override will set the following defaults: + +### Amazon Route53 +* Adds an ALIAS record to the new or provided Hosted Zone that routes to the construct's ALB + +### Application Load Balancer +* Creates an Application Load Balancer with no Listener or target. The consruct can incorporate an existing, fully configured ALB if provided. + +## Architecture +![Architecture Diagram](architecture.png) + +*** +© Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/architecture.png b/source/patterns/@aws-solutions-constructs/aws-route53-alb/architecture.png new file mode 100644 index 000000000..0a2858f5d Binary files /dev/null and b/source/patterns/@aws-solutions-constructs/aws-route53-alb/architecture.png differ diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/lib/index.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/lib/index.ts new file mode 100644 index 000000000..0f2d0ba97 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/lib/index.ts @@ -0,0 +1,175 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +// Imports +import * as defaults from "@aws-solutions-constructs/core"; +import * as elb from "@aws-cdk/aws-elasticloadbalancingv2"; +import * as s3 from "@aws-cdk/aws-s3"; +import * as r53 from "@aws-cdk/aws-route53"; +import * as r53t from '@aws-cdk/aws-route53-targets'; +// Note: To ensure CDKv2 compatibility, keep the import statement for Construct separate +import { Construct } from '@aws-cdk/core'; +import * as ec2 from '@aws-cdk/aws-ec2'; + +export interface Route53ToAlbProps { + /** + * Custom properties for a new Private Hosted Zone. Cannot be specified for a + * public API. Cannot specify a VPC + * + * @default - None + */ + readonly privateHostedZoneProps?: r53.PrivateHostedZoneProps | any, + /** + * Existing Public or Private Hosted Zone. If a Private Hosted Zone, must + * exist in the same VPC specified in existingVpc + * + * @default - None + */ + readonly existingHostedZoneInterface?: r53.IHostedZone, + /** + * Custom properties for a new ALB. Providing both this and existingLoadBalancerObj + * is an error. These properties cannot include a VPC. + * + * @default - None + */ + readonly loadBalancerProps?: elb.ApplicationLoadBalancerProps | any, + /** + * An existing Application Load Balancer. Providing both this and loadBalancerProps + * is an error. This ALB must exist in the same VPC specified in existingVPC + * + * @default - None + */ + readonly existingLoadBalancerObj?: elb.ApplicationLoadBalancer, + /** + * Whether to turn on Access Logs for the Application Load Balancer. Uses an S3 bucket + * with associated storage costs. Enabling Access Logging is a best practice. + * + * @default - true + */ + readonly logAccessLogs?: boolean, + /** + * Optional properties to customize the bucket used to store the ALB Access + * Logs. Supplying this and setting logAccessLogs to false is an error. + * + * @default - none + */ + readonly loggingBucketProps?: s3.BucketProps, + /** + * Custom properties for a new VPC. Providing both this and existingVpc is + * an error. If an existingAlb or existing Private Hosted Zone is provided, those + * already exist in a VPC so this value cannot be provided. + * + * @default - None + */ + readonly vpcProps?: ec2.VpcProps, + /** + * An existing VPC. Providing both this and vpcProps is an error. If an existingAlb or existing + * Private Hosted Zone is provided, this value must be the VPC associated with those resources. + * + * @default - None + */ + readonly existingVpc?: ec2.IVpc, + /** + * Whether to create a public or private API. This value has implications + * for the VPC, the type of Hosted Zone and the Application Load Balancer + * + * @default - None + */ + readonly publicApi: boolean +} + +/** + * @summary Configures a Route53 Hosted Zone to route to an Application Load Balancer + */ +export class Route53ToAlb extends Construct { + public readonly hostedZone: r53.IHostedZone; + public readonly vpc: ec2.IVpc; + public readonly loadBalancer: elb.ApplicationLoadBalancer; + + /** + * @summary Constructs a new instance of the Route53ToAlb class. + * @param {cdk.App} scope - represents the scope for all the resources. + * @param {string} id - this is a a scope-unique id. + * @param {Route53ToAlbProps} props - user provided props for the construct. + * @access public + */ + constructor(scope: Construct, id: string, props: Route53ToAlbProps) { + super(scope, id); + defaults.CheckProps(props); + + if ((props?.logAccessLogs === false) && (props.loggingBucketProps)) { + throw new Error('If logAccessLogs is false, supplying loggingBucketProps is invalid.'); + } + + if (props?.loadBalancerProps?.vpc) { + throw new Error('Specify any existing VPC at the construct level, not within loadBalancerProps.'); + } + + if (props.existingLoadBalancerObj && !props.existingVpc) { + throw new Error('An existing ALB already exists in a VPC, so that VPC must be passed to the construct in props.existingVpc'); + } + + if (props.existingHostedZoneInterface && !props.publicApi && !props.existingVpc) { + throw new Error('An existing Private Hosted Zone already exists in a VPC, so that VPC must be passed to the construct in props.existingVpc'); + } + + if (props.existingVpc) { + this.vpc = props.existingVpc; + } else { + this.vpc = defaults.buildVpc(scope, { + defaultVpcProps: props.publicApi ? + defaults.DefaultPublicPrivateVpcProps() : + // If this is an internal app, we're going to turn on DNS + // by default to allow gateway and interface service endpoints + defaults.overrideProps(defaults.DefaultIsolatedVpcProps(), { enableDnsHostnames: true, enableDnsSupport: true, }), + userVpcProps: props.vpcProps, + }); + } + + if (props.existingHostedZoneInterface) { + this.hostedZone = props.existingHostedZoneInterface; + } else { + if (props.publicApi) { + throw new Error('Public APIs require an existingHostedZone be passed in the Props object.'); + } else { + if (!props.privateHostedZoneProps) { + throw new Error('Must supply privateHostedZoneProps to create a private API'); + } + if (props.privateHostedZoneProps.vpc) { + throw new Error('All VPC specs must be provided at the Construct level in Route53ToAlbProps'); + } + const manufacturedProps: r53.PrivateHostedZoneProps = defaults.overrideProps(props.privateHostedZoneProps, { vpc: this.vpc }); + this.hostedZone = new r53.PrivateHostedZone(this, `${id}-zone`, manufacturedProps); + } + } + + this.loadBalancer = defaults.ObtainAlb( + this, + id, + this.vpc, + props.publicApi, + props.existingLoadBalancerObj, + props.loadBalancerProps, + props.logAccessLogs, + props.loggingBucketProps + ); + + // Add the ALB to the HostedZone as a target + const hostedZoneTarget = new r53t.LoadBalancerTarget(this.loadBalancer); + + new r53.ARecord(this, `${id}-alias`, { + target: { aliasTarget: hostedZoneTarget }, + zone: this.hostedZone + }); + } +} diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/package.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/package.json new file mode 100644 index 000000000..43f2be976 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/package.json @@ -0,0 +1,109 @@ +{ + "name": "@aws-solutions-constructs/aws-route53-alb", + "version": "0.0.0", + "description": "CDK constructs for defining an interaction between an Amazon Route53 domain and an Application Load Balancer.", + "main": "lib/index.js", + "types": "lib/index.d.ts", + "repository": { + "type": "git", + "url": "https://github.com/awslabs/aws-solutions-constructs.git", + "directory": "source/patterns/@aws-solutions-constructs/aws-route53-alb" + }, + "author": { + "name": "Amazon Web Services", + "url": "https://aws.amazon.com", + "organization": true + }, + "license": "Apache-2.0", + "scripts": { + "build": "tsc -b .", + "lint": "eslint -c ../eslintrc.yml --ext=.js,.ts . && tslint --project .", + "lint-fix": "eslint -c ../eslintrc.yml --ext=.js,.ts --fix .", + "test": "jest --coverage", + "clean": "tsc -b --clean", + "watch": "tsc -b -w", + "integ": "cdk-integ", + "integ-assert": "cdk-integ-assert", + "integ-no-clean": "cdk-integ --no-clean", + "jsii": "jsii", + "jsii-pacmak": "jsii-pacmak", + "build+lint+test": "npm run jsii && npm run lint && npm test && npm run integ-assert", + "snapshot-update": "npm run jsii && npm test -- -u && npm run integ-assert" + }, + "jsii": { + "outdir": "dist", + "targets": { + "java": { + "package": "software.amazon.awsconstructs.services.route53alb", + "maven": { + "groupId": "software.amazon.awsconstructs", + "artifactId": "route53alb" + } + }, + "dotnet": { + "namespace": "Amazon.Constructs.AWS.Route53Alb", + "packageId": "Amazon.Constructs.AWS.Route53Alb", + "signAssembly": true, + "iconUrl": "https://raw.githubusercontent.com/aws/aws-cdk/master/logo/default-256-dark.png" + }, + "python": { + "distName": "aws-solutions-constructs.aws_route53_alb", + "module": "aws_solutions_constructs.aws_route53_alb" + } + } + }, + "dependencies": { + "@aws-cdk/aws-ec2": "0.0.0", + "@aws-cdk/aws-elasticloadbalancingv2": "0.0.0", + "@aws-cdk/aws-route53": "0.0.0", + "@aws-cdk/aws-route53-targets": "0.0.0", + "@aws-cdk/aws-s3": "0.0.0", + "@aws-cdk/core": "0.0.0", + "@aws-solutions-constructs/core": "0.0.0", + "constructs": "^3.2.0" + }, + "devDependencies": { + "@aws-cdk/assert": "0.0.0", + "@types/jest": "^26.0.22", + "@aws-cdk/aws-ec2": "0.0.0", + "@aws-cdk/aws-elasticloadbalancingv2": "0.0.0", + "@aws-cdk/aws-route53": "0.0.0", + "@aws-cdk/aws-route53-targets": "0.0.0", + "@aws-cdk/aws-s3": "0.0.0", + "@aws-cdk/core": "0.0.0", + "@aws-solutions-constructs/core": "0.0.0", + "constructs": "3.2.0", + "@types/node": "^10.3.0" + }, + "jest": { + "moduleFileExtensions": [ + "js" + ], + "coverageReporters": [ + "text", + [ + "lcov", + { + "projectRoot": "../../../../" + } + ] + ] + }, + "peerDependencies": { + "@aws-cdk/aws-ec2": "0.0.0", + "@aws-cdk/aws-elasticloadbalancingv2": "0.0.0", + "@aws-cdk/aws-route53": "0.0.0", + "@aws-cdk/aws-route53-targets": "0.0.0", + "@aws-cdk/core": "0.0.0", + "@aws-solutions-constructs/core": "0.0.0", + "constructs": "^3.2.0" + }, + "keywords": [ + "aws", + "cdk", + "awscdk", + "AWS Solutions Constructs", + "Amazon Route53", + "Application Load Balancing" + ] +} \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.expected.json new file mode 100644 index 000000000..c636b74f1 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.expected.json @@ -0,0 +1,561 @@ +{ + "Description": "Integration Test for aws-route53-alb", + "Resources": { + "privateapistackprivateapistackzone3E5194E7": { + "Type": "AWS::Route53::HostedZone", + "Properties": { + "Name": "www.example.com.", + "VPCs": [ + { + "VPCId": { + "Ref": "Vpc8378EB38" + }, + "VPCRegion": "us-east-1" + } + ] + } + }, + "privateapistackprivateapistackalb7242E759": { + "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", + "Properties": { + "LoadBalancerAttributes": [ + { + "Key": "deletion_protection.enabled", + "Value": "false" + }, + { + "Key": "access_logs.s3.enabled", + "Value": "true" + }, + { + "Key": "access_logs.s3.bucket", + "Value": { + "Ref": "privateapistack09C932BB" + } + }, + { + "Key": "access_logs.s3.prefix", + "Value": "" + } + ], + "Scheme": "internal", + "SecurityGroups": [ + { + "Fn::GetAtt": [ + "privateapistackprivateapistackalbSecurityGroup5A8A9725", + "GroupId" + ] + } + ], + "Subnets": [ + { + "Ref": "VpcisolatedSubnet1SubnetE62B1B9B" + }, + { + "Ref": "VpcisolatedSubnet2Subnet39217055" + }, + { + "Ref": "VpcisolatedSubnet3Subnet44F2537D" + } + ], + "Type": "application" + }, + "DependsOn": [ + "privateapistackPolicy98558170", + "privateapistack09C932BB" + ] + }, + "privateapistackprivateapistackalbSecurityGroup5A8A9725": { + "Type": "AWS::EC2::SecurityGroup", + "Properties": { + "GroupDescription": "Automatically created Security Group for ELB deployPrivateApiprivateapistackprivateapistackalb5DF93E18", + "SecurityGroupEgress": [ + { + "CidrIp": "255.255.255.255/32", + "Description": "Disallow all traffic", + "FromPort": 252, + "IpProtocol": "icmp", + "ToPort": 86 + } + ], + "VpcId": { + "Ref": "Vpc8378EB38" + } + }, + "DependsOn": [ + "privateapistackPolicy98558170", + "privateapistack09C932BB" + ], + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W29", + "reason": "CDK created rule that blocks all traffic." + } + ] + } + } + }, + "privateapistack09C932BB": { + "Type": "AWS::S3::Bucket", + "Properties": { + "BucketEncryption": { + "ServerSideEncryptionConfiguration": [ + { + "ServerSideEncryptionByDefault": { + "SSEAlgorithm": "AES256" + } + } + ] + }, + "PublicAccessBlockConfiguration": { + "BlockPublicAcls": true, + "BlockPublicPolicy": true, + "IgnorePublicAcls": true, + "RestrictPublicBuckets": true + }, + "VersioningConfiguration": { + "Status": "Enabled" + } + }, + "UpdateReplacePolicy": "Retain", + "DeletionPolicy": "Retain", + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W35", + "reason": "This is a log bucket for an Application Load Balancer" + } + ] + } + } + }, + "privateapistackPolicy98558170": { + "Type": "AWS::S3::BucketPolicy", + "Properties": { + "Bucket": { + "Ref": "privateapistack09C932BB" + }, + "PolicyDocument": { + "Statement": [ + { + "Action": "*", + "Condition": { + "Bool": { + "aws:SecureTransport": "false" + } + }, + "Effect": "Deny", + "Principal": { + "AWS": "*" + }, + "Resource": [ + { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "privateapistack09C932BB", + "Arn" + ] + }, + "/*" + ] + ] + }, + { + "Fn::GetAtt": [ + "privateapistack09C932BB", + "Arn" + ] + } + ], + "Sid": "HttpsOnly" + }, + { + "Action": [ + "s3:PutObject", + "s3:Abort*" + ], + "Effect": "Allow", + "Principal": { + "AWS": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::127311923021:root" + ] + ] + } + }, + "Resource": { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "privateapistack09C932BB", + "Arn" + ] + }, + "/AWSLogs/", + { + "Ref": "AWS::AccountId" + }, + "/*" + ] + ] + } + } + ], + "Version": "2012-10-17" + } + } + }, + "privateapistackprivateapistackalias54E3713F": { + "Type": "AWS::Route53::RecordSet", + "Properties": { + "Name": "www.example.com.", + "Type": "A", + "AliasTarget": { + "DNSName": { + "Fn::Join": [ + "", + [ + "dualstack.", + { + "Fn::GetAtt": [ + "privateapistackprivateapistackalb7242E759", + "DNSName" + ] + } + ] + ] + }, + "HostedZoneId": { + "Fn::GetAtt": [ + "privateapistackprivateapistackalb7242E759", + "CanonicalHostedZoneID" + ] + } + }, + "HostedZoneId": { + "Ref": "privateapistackprivateapistackzone3E5194E7" + } + } + }, + "Vpc8378EB38": { + "Type": "AWS::EC2::VPC", + "Properties": { + "CidrBlock": "10.0.0.0/16", + "EnableDnsHostnames": true, + "EnableDnsSupport": true, + "InstanceTenancy": "default", + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApi/Vpc" + } + ] + } + }, + "VpcisolatedSubnet1SubnetE62B1B9B": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "10.0.0.0/18", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1a", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "isolated" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Isolated" + }, + { + "Key": "Name", + "Value": "deployPrivateApi/Vpc/isolatedSubnet1" + } + ] + } + }, + "VpcisolatedSubnet1RouteTableE442650B": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApi/Vpc/isolatedSubnet1" + } + ] + } + }, + "VpcisolatedSubnet1RouteTableAssociationD259E31A": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcisolatedSubnet1RouteTableE442650B" + }, + "SubnetId": { + "Ref": "VpcisolatedSubnet1SubnetE62B1B9B" + } + } + }, + "VpcisolatedSubnet2Subnet39217055": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "10.0.64.0/18", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1b", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "isolated" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Isolated" + }, + { + "Key": "Name", + "Value": "deployPrivateApi/Vpc/isolatedSubnet2" + } + ] + } + }, + "VpcisolatedSubnet2RouteTable334F9764": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApi/Vpc/isolatedSubnet2" + } + ] + } + }, + "VpcisolatedSubnet2RouteTableAssociation25A4716F": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcisolatedSubnet2RouteTable334F9764" + }, + "SubnetId": { + "Ref": "VpcisolatedSubnet2Subnet39217055" + } + } + }, + "VpcisolatedSubnet3Subnet44F2537D": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "10.0.128.0/18", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1c", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "isolated" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Isolated" + }, + { + "Key": "Name", + "Value": "deployPrivateApi/Vpc/isolatedSubnet3" + } + ] + } + }, + "VpcisolatedSubnet3RouteTableA2F6BBC0": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApi/Vpc/isolatedSubnet3" + } + ] + } + }, + "VpcisolatedSubnet3RouteTableAssociationDC010BEB": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcisolatedSubnet3RouteTableA2F6BBC0" + }, + "SubnetId": { + "Ref": "VpcisolatedSubnet3Subnet44F2537D" + } + } + }, + "VpcFlowLogIAMRole6A475D41": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "vpc-flow-logs.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApi/Vpc" + } + ] + } + }, + "VpcFlowLogIAMRoleDefaultPolicy406FB995": { + "Type": "AWS::IAM::Policy", + "Properties": { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "logs:CreateLogStream", + "logs:PutLogEvents", + "logs:DescribeLogStreams" + ], + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogLogGroup7B5C56B9", + "Arn" + ] + } + }, + { + "Action": "iam:PassRole", + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + } + } + ], + "Version": "2012-10-17" + }, + "PolicyName": "VpcFlowLogIAMRoleDefaultPolicy406FB995", + "Roles": [ + { + "Ref": "VpcFlowLogIAMRole6A475D41" + } + ] + } + }, + "VpcFlowLogLogGroup7B5C56B9": { + "Type": "AWS::Logs::LogGroup", + "Properties": { + "RetentionInDays": 731 + }, + "UpdateReplacePolicy": "Retain", + "DeletionPolicy": "Retain", + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W84", + "reason": "By default CloudWatchLogs LogGroups data is encrypted using the CloudWatch server-side encryption keys (AWS Managed Keys)" + } + ] + } + } + }, + "VpcFlowLog8FF33A73": { + "Type": "AWS::EC2::FlowLog", + "Properties": { + "ResourceId": { + "Ref": "Vpc8378EB38" + }, + "ResourceType": "VPC", + "TrafficType": "ALL", + "DeliverLogsPermissionArn": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + }, + "LogDestinationType": "cloud-watch-logs", + "LogGroupName": { + "Ref": "VpcFlowLogLogGroup7B5C56B9" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApi/Vpc" + } + ] + } + } + }, + "Parameters": { + "BootstrapVersion": { + "Type": "AWS::SSM::Parameter::Value", + "Default": "/cdk-bootstrap/hnb659fds/version", + "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store." + } + }, + "Rules": { + "CheckBootstrapVersion": { + "Assertions": [ + { + "Assert": { + "Fn::Not": [ + { + "Fn::Contains": [ + [ + "1", + "2", + "3", + "4", + "5" + ], + { + "Ref": "BootstrapVersion" + } + ] + } + ] + }, + "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." + } + ] + } + } +} \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.ts new file mode 100644 index 000000000..d42a2a964 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.ts @@ -0,0 +1,42 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +// Imports +import { App, Stack, Aws } from "@aws-cdk/core"; +import { Route53ToAlb, Route53ToAlbProps } from "../lib"; +import { generateIntegStackName } from '@aws-solutions-constructs/core'; +import * as defaults from '@aws-solutions-constructs/core'; +import { CfnSecurityGroup } from "@aws-cdk/aws-ec2"; + +// Setup +const app = new App(); +const stack = new Stack(app, generateIntegStackName(__filename), { + env: { account: Aws.ACCOUNT_ID, region: 'us-east-1' }, +}); +stack.templateOptions.description = 'Integration Test for aws-route53-alb'; + +// Definitions +const props: Route53ToAlbProps = { + publicApi: false, + privateHostedZoneProps: { + zoneName: 'www.example.com' + } +}; + +const testConstruct = new Route53ToAlb(stack, 'private-api-stack', props); + +const newSecurityGroup = testConstruct.loadBalancer.connections.securityGroups[0].node.defaultChild as CfnSecurityGroup; +defaults.addCfnSuppressRules(newSecurityGroup, [{ id: 'W29', reason: 'CDK created rule that blocks all traffic.'}]); + +// Synth +app.synth(); \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.expected.json new file mode 100644 index 000000000..66affb07f --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.expected.json @@ -0,0 +1,940 @@ +{ + "Description": "Integration Test for aws-route53-alb", + "Resources": { + "Vpc8378EB38": { + "Type": "AWS::EC2::VPC", + "Properties": { + "CidrBlock": "172.168.0.0/16", + "EnableDnsHostnames": true, + "EnableDnsSupport": true, + "InstanceTenancy": "default", + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc" + } + ] + } + }, + "VpcPublicSubnet1Subnet5C2D37C4": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.0.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1a", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet1" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet1RouteTable6C95E38E": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet1RouteTableAssociation97140677": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet1RouteTable6C95E38E" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet1Subnet5C2D37C4" + } + } + }, + "VpcPublicSubnet1DefaultRoute3DA9E72A": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet1RouteTable6C95E38E" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet1EIPD7E02669": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet1NATGateway4D7517AA": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet1Subnet5C2D37C4" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet1EIPD7E02669", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet2Subnet691E08A3": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.32.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1b", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet2" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet2RouteTable94F7E489": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet2RouteTableAssociationDD5762D8": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet2RouteTable94F7E489" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet2Subnet691E08A3" + } + } + }, + "VpcPublicSubnet2DefaultRoute97F91067": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet2RouteTable94F7E489" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet2EIP3C605A87": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet2NATGateway9182C01D": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet2Subnet691E08A3" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet2EIP3C605A87", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet3SubnetBE12F0B6": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.64.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1c", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet3" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet3RouteTable93458DBB": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPublicSubnet3RouteTableAssociation1F1EDF02": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet3RouteTable93458DBB" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet3SubnetBE12F0B6" + } + } + }, + "VpcPublicSubnet3DefaultRoute4697774F": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet3RouteTable93458DBB" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet3EIP3A666A23": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPublicSubnet3NATGateway7640CD1D": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet3SubnetBE12F0B6" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet3EIP3A666A23", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPrivateSubnet1Subnet536B997A": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.96.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1a", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PrivateSubnet1" + } + ] + } + }, + "VpcPrivateSubnet1RouteTableB2C5B500": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PrivateSubnet1" + } + ] + } + }, + "VpcPrivateSubnet1RouteTableAssociation70C59FA6": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet1RouteTableB2C5B500" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet1Subnet536B997A" + } + } + }, + "VpcPrivateSubnet1DefaultRouteBE02A9ED": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet1RouteTableB2C5B500" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet1NATGateway4D7517AA" + } + } + }, + "VpcPrivateSubnet2Subnet3788AAA1": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.128.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1b", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PrivateSubnet2" + } + ] + } + }, + "VpcPrivateSubnet2RouteTableA678073B": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PrivateSubnet2" + } + ] + } + }, + "VpcPrivateSubnet2RouteTableAssociationA89CAD56": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet2RouteTableA678073B" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet2Subnet3788AAA1" + } + } + }, + "VpcPrivateSubnet2DefaultRoute060D2087": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet2RouteTableA678073B" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet2NATGateway9182C01D" + } + } + }, + "VpcPrivateSubnet3SubnetF258B56E": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.160.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1c", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PrivateSubnet3" + } + ] + } + }, + "VpcPrivateSubnet3RouteTableD98824C7": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PrivateSubnet3" + } + ] + } + }, + "VpcPrivateSubnet3RouteTableAssociation16BDDC43": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet3RouteTableD98824C7" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet3SubnetF258B56E" + } + } + }, + "VpcPrivateSubnet3DefaultRoute94B74F0D": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet3RouteTableD98824C7" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet3NATGateway7640CD1D" + } + } + }, + "VpcIGWD7BA715C": { + "Type": "AWS::EC2::InternetGateway", + "Properties": { + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc" + } + ] + } + }, + "VpcVPCGWBF912B6E": { + "Type": "AWS::EC2::VPCGatewayAttachment", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "InternetGatewayId": { + "Ref": "VpcIGWD7BA715C" + } + } + }, + "VpcFlowLogIAMRole6A475D41": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "vpc-flow-logs.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc" + } + ] + } + }, + "VpcFlowLogIAMRoleDefaultPolicy406FB995": { + "Type": "AWS::IAM::Policy", + "Properties": { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "logs:CreateLogStream", + "logs:PutLogEvents", + "logs:DescribeLogStreams" + ], + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogLogGroup7B5C56B9", + "Arn" + ] + } + }, + { + "Action": "iam:PassRole", + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + } + } + ], + "Version": "2012-10-17" + }, + "PolicyName": "VpcFlowLogIAMRoleDefaultPolicy406FB995", + "Roles": [ + { + "Ref": "VpcFlowLogIAMRole6A475D41" + } + ] + } + }, + "VpcFlowLogLogGroup7B5C56B9": { + "Type": "AWS::Logs::LogGroup", + "Properties": { + "RetentionInDays": 731 + }, + "UpdateReplacePolicy": "Retain", + "DeletionPolicy": "Retain", + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W84", + "reason": "By default CloudWatchLogs LogGroups data is encrypted using the CloudWatch server-side encryption keys (AWS Managed Keys)" + } + ] + } + } + }, + "VpcFlowLog8FF33A73": { + "Type": "AWS::EC2::FlowLog", + "Properties": { + "ResourceId": { + "Ref": "Vpc8378EB38" + }, + "ResourceType": "VPC", + "TrafficType": "ALL", + "DeliverLogsPermissionArn": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + }, + "LogDestinationType": "cloud-watch-logs", + "LogGroupName": { + "Ref": "VpcFlowLogLogGroup7B5C56B9" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc" + } + ] + } + }, + "newzone1D011936": { + "Type": "AWS::Route53::HostedZone", + "Properties": { + "Name": "www.test-example.com.", + "VPCs": [ + { + "VPCId": { + "Ref": "Vpc8378EB38" + }, + "VPCRegion": "us-east-1" + } + ] + } + }, + "existingzonestackexistingzonestackalbCFB3D7E4": { + "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", + "Properties": { + "LoadBalancerAttributes": [ + { + "Key": "deletion_protection.enabled", + "Value": "false" + }, + { + "Key": "access_logs.s3.enabled", + "Value": "true" + }, + { + "Key": "access_logs.s3.bucket", + "Value": { + "Ref": "existingzonestackEFB9F5B3" + } + }, + { + "Key": "access_logs.s3.prefix", + "Value": "" + } + ], + "Scheme": "internal", + "SecurityGroups": [ + { + "Fn::GetAtt": [ + "existingzonestackexistingzonestackalbSecurityGroup6F32DCA5", + "GroupId" + ] + } + ], + "Subnets": [ + { + "Ref": "VpcPrivateSubnet1Subnet536B997A" + }, + { + "Ref": "VpcPrivateSubnet2Subnet3788AAA1" + }, + { + "Ref": "VpcPrivateSubnet3SubnetF258B56E" + } + ], + "Type": "application" + }, + "DependsOn": [ + "existingzonestackPolicyFEC9C88E", + "existingzonestackEFB9F5B3" + ] + }, + "existingzonestackexistingzonestackalbSecurityGroup6F32DCA5": { + "Type": "AWS::EC2::SecurityGroup", + "Properties": { + "GroupDescription": "Automatically created Security Group for ELB deployPrivateApiExistingZoneexistingzonestackexistingzonestackalbFBEA12EB", + "SecurityGroupEgress": [ + { + "CidrIp": "255.255.255.255/32", + "Description": "Disallow all traffic", + "FromPort": 252, + "IpProtocol": "icmp", + "ToPort": 86 + } + ], + "VpcId": { + "Ref": "Vpc8378EB38" + } + }, + "DependsOn": [ + "existingzonestackPolicyFEC9C88E", + "existingzonestackEFB9F5B3" + ], + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W29", + "reason": "CDK created rule that blocks all traffic." + } + ] + } + } + }, + "existingzonestackEFB9F5B3": { + "Type": "AWS::S3::Bucket", + "Properties": { + "BucketEncryption": { + "ServerSideEncryptionConfiguration": [ + { + "ServerSideEncryptionByDefault": { + "SSEAlgorithm": "AES256" + } + } + ] + }, + "PublicAccessBlockConfiguration": { + "BlockPublicAcls": true, + "BlockPublicPolicy": true, + "IgnorePublicAcls": true, + "RestrictPublicBuckets": true + }, + "VersioningConfiguration": { + "Status": "Enabled" + } + }, + "UpdateReplacePolicy": "Retain", + "DeletionPolicy": "Retain", + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W35", + "reason": "This is a log bucket for an Application Load Balancer" + } + ] + } + } + }, + "existingzonestackPolicyFEC9C88E": { + "Type": "AWS::S3::BucketPolicy", + "Properties": { + "Bucket": { + "Ref": "existingzonestackEFB9F5B3" + }, + "PolicyDocument": { + "Statement": [ + { + "Action": "*", + "Condition": { + "Bool": { + "aws:SecureTransport": "false" + } + }, + "Effect": "Deny", + "Principal": { + "AWS": "*" + }, + "Resource": [ + { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "existingzonestackEFB9F5B3", + "Arn" + ] + }, + "/*" + ] + ] + }, + { + "Fn::GetAtt": [ + "existingzonestackEFB9F5B3", + "Arn" + ] + } + ], + "Sid": "HttpsOnly" + }, + { + "Action": [ + "s3:PutObject", + "s3:Abort*" + ], + "Effect": "Allow", + "Principal": { + "AWS": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::127311923021:root" + ] + ] + } + }, + "Resource": { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "existingzonestackEFB9F5B3", + "Arn" + ] + }, + "/AWSLogs/", + { + "Ref": "AWS::AccountId" + }, + "/*" + ] + ] + } + } + ], + "Version": "2012-10-17" + } + } + }, + "existingzonestackexistingzonestackalias77D2E65D": { + "Type": "AWS::Route53::RecordSet", + "Properties": { + "Name": "www.test-example.com.", + "Type": "A", + "AliasTarget": { + "DNSName": { + "Fn::Join": [ + "", + [ + "dualstack.", + { + "Fn::GetAtt": [ + "existingzonestackexistingzonestackalbCFB3D7E4", + "DNSName" + ] + } + ] + ] + }, + "HostedZoneId": { + "Fn::GetAtt": [ + "existingzonestackexistingzonestackalbCFB3D7E4", + "CanonicalHostedZoneID" + ] + } + }, + "HostedZoneId": { + "Ref": "newzone1D011936" + } + } + } + }, + "Parameters": { + "BootstrapVersion": { + "Type": "AWS::SSM::Parameter::Value", + "Default": "/cdk-bootstrap/hnb659fds/version", + "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store." + } + }, + "Rules": { + "CheckBootstrapVersion": { + "Assertions": [ + { + "Assert": { + "Fn::Not": [ + { + "Fn::Contains": [ + [ + "1", + "2", + "3", + "4", + "5" + ], + { + "Ref": "BootstrapVersion" + } + ] + } + ] + }, + "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." + } + ] + } + } +} \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.ts new file mode 100644 index 000000000..85c8ffee8 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.ts @@ -0,0 +1,55 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +// Imports +import { App, Stack, Aws } from "@aws-cdk/core"; +import * as defaults from '@aws-solutions-constructs/core'; +import { PrivateHostedZone } from "@aws-cdk/aws-route53"; +import { Route53ToAlb, Route53ToAlbProps } from "../lib"; +import { CfnSecurityGroup } from "@aws-cdk/aws-ec2"; + +// Setup +const app = new App(); +const stack = new Stack(app, defaults.generateIntegStackName(__filename), { + env: { account: Aws.ACCOUNT_ID, region: 'us-east-1' }, +}); +stack.templateOptions.description = 'Integration Test for aws-route53-alb'; + +const newVpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + constructVpcProps: { + enableDnsHostnames: true, + enableDnsSupport: true, + cidr: '172.168.0.0/16', + }, +}); + +const newZone = new PrivateHostedZone(stack, 'new-zone', { + zoneName: 'www.test-example.com', + vpc: newVpc, +}); + +// Definitions +const props: Route53ToAlbProps = { + publicApi: false, + existingHostedZoneInterface: newZone, + existingVpc: newVpc, +}; + +const testConstruct = new Route53ToAlb(stack, 'existing-zone-stack', props); + +const newSecurityGroup = testConstruct.loadBalancer.connections.securityGroups[0].node.defaultChild as CfnSecurityGroup; +defaults.addCfnSuppressRules(newSecurityGroup, [{ id: 'W29', reason: 'CDK created rule that blocks all traffic.'}]); + +// Synth +app.synth(); \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.expected.json new file mode 100644 index 000000000..b6c97fb8b --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.expected.json @@ -0,0 +1,798 @@ +{ + "Description": "Integration Test for aws-route53-alb", + "Resources": { + "Vpc8378EB38": { + "Type": "AWS::EC2::VPC", + "Properties": { + "CidrBlock": "172.168.0.0/16", + "EnableDnsHostnames": true, + "EnableDnsSupport": true, + "InstanceTenancy": "default", + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc" + } + ] + } + }, + "VpcPublicSubnet1Subnet5C2D37C4": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.0.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1a", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet1" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet1RouteTable6C95E38E": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet1RouteTableAssociation97140677": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet1RouteTable6C95E38E" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet1Subnet5C2D37C4" + } + } + }, + "VpcPublicSubnet1DefaultRoute3DA9E72A": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet1RouteTable6C95E38E" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet1EIPD7E02669": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet1NATGateway4D7517AA": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet1Subnet5C2D37C4" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet1EIPD7E02669", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet2Subnet691E08A3": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.32.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1b", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet2" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet2RouteTable94F7E489": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet2RouteTableAssociationDD5762D8": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet2RouteTable94F7E489" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet2Subnet691E08A3" + } + } + }, + "VpcPublicSubnet2DefaultRoute97F91067": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet2RouteTable94F7E489" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet2EIP3C605A87": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet2NATGateway9182C01D": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet2Subnet691E08A3" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet2EIP3C605A87", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet3SubnetBE12F0B6": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.64.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1c", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet3" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet3RouteTable93458DBB": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPublicSubnet3RouteTableAssociation1F1EDF02": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet3RouteTable93458DBB" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet3SubnetBE12F0B6" + } + } + }, + "VpcPublicSubnet3DefaultRoute4697774F": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet3RouteTable93458DBB" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet3EIP3A666A23": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPublicSubnet3NATGateway7640CD1D": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet3SubnetBE12F0B6" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet3EIP3A666A23", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPrivateSubnet1Subnet536B997A": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.96.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1a", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PrivateSubnet1" + } + ] + } + }, + "VpcPrivateSubnet1RouteTableB2C5B500": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PrivateSubnet1" + } + ] + } + }, + "VpcPrivateSubnet1RouteTableAssociation70C59FA6": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet1RouteTableB2C5B500" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet1Subnet536B997A" + } + } + }, + "VpcPrivateSubnet1DefaultRouteBE02A9ED": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet1RouteTableB2C5B500" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet1NATGateway4D7517AA" + } + } + }, + "VpcPrivateSubnet2Subnet3788AAA1": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.128.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1b", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PrivateSubnet2" + } + ] + } + }, + "VpcPrivateSubnet2RouteTableA678073B": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PrivateSubnet2" + } + ] + } + }, + "VpcPrivateSubnet2RouteTableAssociationA89CAD56": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet2RouteTableA678073B" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet2Subnet3788AAA1" + } + } + }, + "VpcPrivateSubnet2DefaultRoute060D2087": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet2RouteTableA678073B" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet2NATGateway9182C01D" + } + } + }, + "VpcPrivateSubnet3SubnetF258B56E": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.160.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1c", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PrivateSubnet3" + } + ] + } + }, + "VpcPrivateSubnet3RouteTableD98824C7": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PrivateSubnet3" + } + ] + } + }, + "VpcPrivateSubnet3RouteTableAssociation16BDDC43": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet3RouteTableD98824C7" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet3SubnetF258B56E" + } + } + }, + "VpcPrivateSubnet3DefaultRoute94B74F0D": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet3RouteTableD98824C7" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet3NATGateway7640CD1D" + } + } + }, + "VpcIGWD7BA715C": { + "Type": "AWS::EC2::InternetGateway", + "Properties": { + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc" + } + ] + } + }, + "VpcVPCGWBF912B6E": { + "Type": "AWS::EC2::VPCGatewayAttachment", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "InternetGatewayId": { + "Ref": "VpcIGWD7BA715C" + } + } + }, + "VpcFlowLogIAMRole6A475D41": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "vpc-flow-logs.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc" + } + ] + } + }, + "VpcFlowLogIAMRoleDefaultPolicy406FB995": { + "Type": "AWS::IAM::Policy", + "Properties": { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "logs:CreateLogStream", + "logs:PutLogEvents", + "logs:DescribeLogStreams" + ], + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogLogGroup7B5C56B9", + "Arn" + ] + } + }, + { + "Action": "iam:PassRole", + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + } + } + ], + "Version": "2012-10-17" + }, + "PolicyName": "VpcFlowLogIAMRoleDefaultPolicy406FB995", + "Roles": [ + { + "Ref": "VpcFlowLogIAMRole6A475D41" + } + ] + } + }, + "VpcFlowLogLogGroup7B5C56B9": { + "Type": "AWS::Logs::LogGroup", + "Properties": { + "RetentionInDays": 731 + }, + "UpdateReplacePolicy": "Retain", + "DeletionPolicy": "Retain", + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W84", + "reason": "By default CloudWatchLogs LogGroups data is encrypted using the CloudWatch server-side encryption keys (AWS Managed Keys)" + } + ] + } + } + }, + "VpcFlowLog8FF33A73": { + "Type": "AWS::EC2::FlowLog", + "Properties": { + "ResourceId": { + "Ref": "Vpc8378EB38" + }, + "ResourceType": "VPC", + "TrafficType": "ALL", + "DeliverLogsPermissionArn": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + }, + "LogDestinationType": "cloud-watch-logs", + "LogGroupName": { + "Ref": "VpcFlowLogLogGroup7B5C56B9" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc" + } + ] + } + }, + "newzone1D011936": { + "Type": "AWS::Route53::HostedZone", + "Properties": { + "Name": "www.test-example.com." + } + }, + "testalb9AFCD824": { + "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", + "Properties": { + "LoadBalancerAttributes": [ + { + "Key": "deletion_protection.enabled", + "Value": "false" + } + ], + "Scheme": "internal", + "SecurityGroups": [ + { + "Fn::GetAtt": [ + "testalbSecurityGroup0C84CDF9", + "GroupId" + ] + } + ], + "Subnets": [ + { + "Ref": "VpcPrivateSubnet1Subnet536B997A" + }, + { + "Ref": "VpcPrivateSubnet2Subnet3788AAA1" + }, + { + "Ref": "VpcPrivateSubnet3SubnetF258B56E" + } + ], + "Type": "application" + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W52", + "reason": "Test ALB only." + } + ] + } + } + }, + "testalbSecurityGroup0C84CDF9": { + "Type": "AWS::EC2::SecurityGroup", + "Properties": { + "GroupDescription": "Automatically created Security Group for ELB deployPublicApiExistingAlbtestalb700DF81E", + "SecurityGroupEgress": [ + { + "CidrIp": "255.255.255.255/32", + "Description": "Disallow all traffic", + "FromPort": 252, + "IpProtocol": "icmp", + "ToPort": 86 + } + ], + "VpcId": { + "Ref": "Vpc8378EB38" + } + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W29", + "reason": "CDK created rule that blocks all traffic." + } + ] + } + } + }, + "publicapistackpublicapistackalias4096038C": { + "Type": "AWS::Route53::RecordSet", + "Properties": { + "Name": "www.test-example.com.", + "Type": "A", + "AliasTarget": { + "DNSName": { + "Fn::Join": [ + "", + [ + "dualstack.", + { + "Fn::GetAtt": [ + "testalb9AFCD824", + "DNSName" + ] + } + ] + ] + }, + "HostedZoneId": { + "Fn::GetAtt": [ + "testalb9AFCD824", + "CanonicalHostedZoneID" + ] + } + }, + "HostedZoneId": { + "Ref": "newzone1D011936" + } + } + } + }, + "Parameters": { + "BootstrapVersion": { + "Type": "AWS::SSM::Parameter::Value", + "Default": "/cdk-bootstrap/hnb659fds/version", + "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store." + } + }, + "Rules": { + "CheckBootstrapVersion": { + "Assertions": [ + { + "Assert": { + "Fn::Not": [ + { + "Fn::Contains": [ + [ + "1", + "2", + "3", + "4", + "5" + ], + { + "Ref": "BootstrapVersion" + } + ] + } + ] + }, + "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." + } + ] + } + } +} \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.ts new file mode 100644 index 000000000..e97ffe3a0 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.ts @@ -0,0 +1,63 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +// Imports +import { App, Stack, Aws } from "@aws-cdk/core"; +import * as defaults from '@aws-solutions-constructs/core'; +import { ApplicationLoadBalancer } from "@aws-cdk/aws-elasticloadbalancingv2"; +import { PublicHostedZone } from "@aws-cdk/aws-route53"; +import { Route53ToAlb, Route53ToAlbProps } from "../lib"; +import { generateIntegStackName } from '@aws-solutions-constructs/core'; +import { CfnSecurityGroup } from "@aws-cdk/aws-ec2"; + +// Setup +const app = new App(); +const stack = new Stack(app, generateIntegStackName(__filename), { + env: { account: Aws.ACCOUNT_ID, region: 'us-east-1' }, +}); +stack.templateOptions.description = 'Integration Test for aws-route53-alb'; + +const newVpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + constructVpcProps: { + enableDnsHostnames: true, + enableDnsSupport: true, + cidr: '172.168.0.0/16', + }, +}); + +const newZone = new PublicHostedZone(stack, 'new-zone', { + zoneName: 'www.test-example.com', +}); + +const existingAlb = new ApplicationLoadBalancer(stack, 'test-alb', { + vpc: newVpc, +}); + +defaults.addCfnSuppressRules(existingAlb, [{ id: 'W52', reason: 'Test ALB only.'}]); + +// Definitions +const props: Route53ToAlbProps = { + publicApi: true, + existingHostedZoneInterface: newZone, + existingVpc: newVpc, + existingLoadBalancerObj: existingAlb, +}; + +const testConstruct = new Route53ToAlb(stack, 'public-api-stack', props); + +const newSecurityGroup = testConstruct.loadBalancer.connections.securityGroups[0].node.defaultChild as CfnSecurityGroup; +defaults.addCfnSuppressRules(newSecurityGroup, [{ id: 'W29', reason: 'CDK created rule that blocks all traffic.'}]); + +// Synth +app.synth(); \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json new file mode 100644 index 000000000..095a9fa5b --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json @@ -0,0 +1,935 @@ +{ + "Description": "Integration Test for aws-route53-alb", + "Resources": { + "newzone1D011936": { + "Type": "AWS::Route53::HostedZone", + "Properties": { + "Name": "www.test-example.com." + } + }, + "newalbstacknewalbstackalb50B67E3E": { + "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", + "Properties": { + "LoadBalancerAttributes": [ + { + "Key": "deletion_protection.enabled", + "Value": "false" + }, + { + "Key": "access_logs.s3.enabled", + "Value": "true" + }, + { + "Key": "access_logs.s3.bucket", + "Value": { + "Ref": "newalbstackADB02838" + } + }, + { + "Key": "access_logs.s3.prefix", + "Value": "" + } + ], + "Scheme": "internet-facing", + "SecurityGroups": [ + { + "Fn::GetAtt": [ + "newalbstacknewalbstackalbSecurityGroup7BBB827C", + "GroupId" + ] + } + ], + "Subnets": [ + { + "Ref": "VpcPublicSubnet1Subnet5C2D37C4" + }, + { + "Ref": "VpcPublicSubnet2Subnet691E08A3" + }, + { + "Ref": "VpcPublicSubnet3SubnetBE12F0B6" + } + ], + "Type": "application" + }, + "DependsOn": [ + "newalbstackPolicyB7C2D898", + "newalbstackADB02838", + "VpcPublicSubnet1DefaultRoute3DA9E72A", + "VpcPublicSubnet2DefaultRoute97F91067", + "VpcPublicSubnet3DefaultRoute4697774F" + ] + }, + "newalbstacknewalbstackalbSecurityGroup7BBB827C": { + "Type": "AWS::EC2::SecurityGroup", + "Properties": { + "GroupDescription": "Automatically created Security Group for ELB deployPublicApiNewAlbnewalbstacknewalbstackalbC987D9E9", + "SecurityGroupEgress": [ + { + "CidrIp": "255.255.255.255/32", + "Description": "Disallow all traffic", + "FromPort": 252, + "IpProtocol": "icmp", + "ToPort": 86 + } + ], + "VpcId": { + "Ref": "Vpc8378EB38" + } + }, + "DependsOn": [ + "newalbstackPolicyB7C2D898", + "newalbstackADB02838" + ], + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W29", + "reason": "CDK created rule that blocks all traffic." + } + ] + } + } + }, + "newalbstackADB02838": { + "Type": "AWS::S3::Bucket", + "Properties": { + "BucketEncryption": { + "ServerSideEncryptionConfiguration": [ + { + "ServerSideEncryptionByDefault": { + "SSEAlgorithm": "AES256" + } + } + ] + }, + "PublicAccessBlockConfiguration": { + "BlockPublicAcls": true, + "BlockPublicPolicy": true, + "IgnorePublicAcls": true, + "RestrictPublicBuckets": true + }, + "VersioningConfiguration": { + "Status": "Enabled" + } + }, + "UpdateReplacePolicy": "Retain", + "DeletionPolicy": "Retain", + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W35", + "reason": "This is a log bucket for an Application Load Balancer" + } + ] + } + } + }, + "newalbstackPolicyB7C2D898": { + "Type": "AWS::S3::BucketPolicy", + "Properties": { + "Bucket": { + "Ref": "newalbstackADB02838" + }, + "PolicyDocument": { + "Statement": [ + { + "Action": "*", + "Condition": { + "Bool": { + "aws:SecureTransport": "false" + } + }, + "Effect": "Deny", + "Principal": { + "AWS": "*" + }, + "Resource": [ + { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "newalbstackADB02838", + "Arn" + ] + }, + "/*" + ] + ] + }, + { + "Fn::GetAtt": [ + "newalbstackADB02838", + "Arn" + ] + } + ], + "Sid": "HttpsOnly" + }, + { + "Action": [ + "s3:PutObject", + "s3:Abort*" + ], + "Effect": "Allow", + "Principal": { + "AWS": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::127311923021:root" + ] + ] + } + }, + "Resource": { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "newalbstackADB02838", + "Arn" + ] + }, + "/AWSLogs/", + { + "Ref": "AWS::AccountId" + }, + "/*" + ] + ] + } + } + ], + "Version": "2012-10-17" + } + } + }, + "newalbstacknewalbstackalias05E0DF53": { + "Type": "AWS::Route53::RecordSet", + "Properties": { + "Name": "www.test-example.com.", + "Type": "A", + "AliasTarget": { + "DNSName": { + "Fn::Join": [ + "", + [ + "dualstack.", + { + "Fn::GetAtt": [ + "newalbstacknewalbstackalb50B67E3E", + "DNSName" + ] + } + ] + ] + }, + "HostedZoneId": { + "Fn::GetAtt": [ + "newalbstacknewalbstackalb50B67E3E", + "CanonicalHostedZoneID" + ] + } + }, + "HostedZoneId": { + "Ref": "newzone1D011936" + } + } + }, + "Vpc8378EB38": { + "Type": "AWS::EC2::VPC", + "Properties": { + "CidrBlock": "10.0.0.0/16", + "EnableDnsHostnames": true, + "EnableDnsSupport": true, + "InstanceTenancy": "default", + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc" + } + ] + } + }, + "VpcPublicSubnet1Subnet5C2D37C4": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "10.0.0.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1a", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet1" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet1RouteTable6C95E38E": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet1RouteTableAssociation97140677": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet1RouteTable6C95E38E" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet1Subnet5C2D37C4" + } + } + }, + "VpcPublicSubnet1DefaultRoute3DA9E72A": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet1RouteTable6C95E38E" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet1EIPD7E02669": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet1NATGateway4D7517AA": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet1Subnet5C2D37C4" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet1EIPD7E02669", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet2Subnet691E08A3": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "10.0.32.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1b", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet2" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet2RouteTable94F7E489": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet2RouteTableAssociationDD5762D8": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet2RouteTable94F7E489" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet2Subnet691E08A3" + } + } + }, + "VpcPublicSubnet2DefaultRoute97F91067": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet2RouteTable94F7E489" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet2EIP3C605A87": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet2NATGateway9182C01D": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet2Subnet691E08A3" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet2EIP3C605A87", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet3SubnetBE12F0B6": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "10.0.64.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1c", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet3" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet3RouteTable93458DBB": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPublicSubnet3RouteTableAssociation1F1EDF02": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet3RouteTable93458DBB" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet3SubnetBE12F0B6" + } + } + }, + "VpcPublicSubnet3DefaultRoute4697774F": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet3RouteTable93458DBB" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet3EIP3A666A23": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPublicSubnet3NATGateway7640CD1D": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet3SubnetBE12F0B6" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet3EIP3A666A23", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPrivateSubnet1Subnet536B997A": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "10.0.96.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1a", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PrivateSubnet1" + } + ] + } + }, + "VpcPrivateSubnet1RouteTableB2C5B500": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PrivateSubnet1" + } + ] + } + }, + "VpcPrivateSubnet1RouteTableAssociation70C59FA6": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet1RouteTableB2C5B500" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet1Subnet536B997A" + } + } + }, + "VpcPrivateSubnet1DefaultRouteBE02A9ED": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet1RouteTableB2C5B500" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet1NATGateway4D7517AA" + } + } + }, + "VpcPrivateSubnet2Subnet3788AAA1": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "10.0.128.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1b", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PrivateSubnet2" + } + ] + } + }, + "VpcPrivateSubnet2RouteTableA678073B": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PrivateSubnet2" + } + ] + } + }, + "VpcPrivateSubnet2RouteTableAssociationA89CAD56": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet2RouteTableA678073B" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet2Subnet3788AAA1" + } + } + }, + "VpcPrivateSubnet2DefaultRoute060D2087": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet2RouteTableA678073B" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet2NATGateway9182C01D" + } + } + }, + "VpcPrivateSubnet3SubnetF258B56E": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "10.0.160.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1c", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PrivateSubnet3" + } + ] + } + }, + "VpcPrivateSubnet3RouteTableD98824C7": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PrivateSubnet3" + } + ] + } + }, + "VpcPrivateSubnet3RouteTableAssociation16BDDC43": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet3RouteTableD98824C7" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet3SubnetF258B56E" + } + } + }, + "VpcPrivateSubnet3DefaultRoute94B74F0D": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet3RouteTableD98824C7" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet3NATGateway7640CD1D" + } + } + }, + "VpcIGWD7BA715C": { + "Type": "AWS::EC2::InternetGateway", + "Properties": { + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc" + } + ] + } + }, + "VpcVPCGWBF912B6E": { + "Type": "AWS::EC2::VPCGatewayAttachment", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "InternetGatewayId": { + "Ref": "VpcIGWD7BA715C" + } + } + }, + "VpcFlowLogIAMRole6A475D41": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "vpc-flow-logs.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc" + } + ] + } + }, + "VpcFlowLogIAMRoleDefaultPolicy406FB995": { + "Type": "AWS::IAM::Policy", + "Properties": { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "logs:CreateLogStream", + "logs:PutLogEvents", + "logs:DescribeLogStreams" + ], + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogLogGroup7B5C56B9", + "Arn" + ] + } + }, + { + "Action": "iam:PassRole", + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + } + } + ], + "Version": "2012-10-17" + }, + "PolicyName": "VpcFlowLogIAMRoleDefaultPolicy406FB995", + "Roles": [ + { + "Ref": "VpcFlowLogIAMRole6A475D41" + } + ] + } + }, + "VpcFlowLogLogGroup7B5C56B9": { + "Type": "AWS::Logs::LogGroup", + "Properties": { + "RetentionInDays": 731 + }, + "UpdateReplacePolicy": "Retain", + "DeletionPolicy": "Retain", + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W84", + "reason": "By default CloudWatchLogs LogGroups data is encrypted using the CloudWatch server-side encryption keys (AWS Managed Keys)" + } + ] + } + } + }, + "VpcFlowLog8FF33A73": { + "Type": "AWS::EC2::FlowLog", + "Properties": { + "ResourceId": { + "Ref": "Vpc8378EB38" + }, + "ResourceType": "VPC", + "TrafficType": "ALL", + "DeliverLogsPermissionArn": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + }, + "LogDestinationType": "cloud-watch-logs", + "LogGroupName": { + "Ref": "VpcFlowLogLogGroup7B5C56B9" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc" + } + ] + } + } + }, + "Parameters": { + "BootstrapVersion": { + "Type": "AWS::SSM::Parameter::Value", + "Default": "/cdk-bootstrap/hnb659fds/version", + "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store." + } + }, + "Rules": { + "CheckBootstrapVersion": { + "Assertions": [ + { + "Assert": { + "Fn::Not": [ + { + "Fn::Contains": [ + [ + "1", + "2", + "3", + "4", + "5" + ], + { + "Ref": "BootstrapVersion" + } + ] + } + ] + }, + "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." + } + ] + } + } +} \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts new file mode 100644 index 000000000..35f8e4d91 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts @@ -0,0 +1,44 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +// Imports +import { App, Stack, Aws } from "@aws-cdk/core"; +import * as defaults from '@aws-solutions-constructs/core'; +import { PublicHostedZone } from "@aws-cdk/aws-route53"; +import { Route53ToAlb, Route53ToAlbProps } from "../lib"; +import { CfnSecurityGroup } from "@aws-cdk/aws-ec2"; + +// Setup +const app = new App(); +const stack = new Stack(app, defaults.generateIntegStackName(__filename), { + env: { account: Aws.ACCOUNT_ID, region: 'us-east-1' }, +}); +stack.templateOptions.description = 'Integration Test for aws-route53-alb'; + +const newZone = new PublicHostedZone(stack, 'new-zone', { + zoneName: 'www.test-example.com', +}); + +// Definitions +const props: Route53ToAlbProps = { + publicApi: true, + existingHostedZoneInterface: newZone, +}; + +const testConstruct = new Route53ToAlb(stack, 'new-alb-stack', props); + +const newSecurityGroup = testConstruct.loadBalancer.connections.securityGroups[0].node.defaultChild as CfnSecurityGroup; +defaults.addCfnSuppressRules(newSecurityGroup, [{ id: 'W29', reason: 'CDK created rule that blocks all traffic.'}]); + +// Synth +app.synth(); \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.expected.json new file mode 100644 index 000000000..ff6a4e693 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.expected.json @@ -0,0 +1,427 @@ +{ + "Description": "Integration Test for aws-route53-alb", + "Resources": { + "nologgingstacknologgingstackzoneE11B9175": { + "Type": "AWS::Route53::HostedZone", + "Properties": { + "Name": "www.example.com.", + "VPCs": [ + { + "VPCId": { + "Ref": "Vpc8378EB38" + }, + "VPCRegion": "us-east-1" + } + ] + } + }, + "nologgingstacknologgingstackalbFD11E34A": { + "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", + "Properties": { + "LoadBalancerAttributes": [ + { + "Key": "deletion_protection.enabled", + "Value": "false" + } + ], + "Scheme": "internal", + "SecurityGroups": [ + { + "Fn::GetAtt": [ + "nologgingstacknologgingstackalbSecurityGroup1C3487C4", + "GroupId" + ] + } + ], + "Subnets": [ + { + "Ref": "VpcisolatedSubnet1SubnetE62B1B9B" + }, + { + "Ref": "VpcisolatedSubnet2Subnet39217055" + }, + { + "Ref": "VpcisolatedSubnet3Subnet44F2537D" + } + ], + "Type": "application" + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W52", + "reason": "This test is explicitly to test the no logging case." + } + ] + } + } + }, + "nologgingstacknologgingstackalbSecurityGroup1C3487C4": { + "Type": "AWS::EC2::SecurityGroup", + "Properties": { + "GroupDescription": "Automatically created Security Group for ELB deployWithoutLoggingnologgingstacknologgingstackalbBA718BE3", + "SecurityGroupEgress": [ + { + "CidrIp": "255.255.255.255/32", + "Description": "Disallow all traffic", + "FromPort": 252, + "IpProtocol": "icmp", + "ToPort": 86 + } + ], + "VpcId": { + "Ref": "Vpc8378EB38" + } + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W29", + "reason": "CDK created rule that blocks all traffic." + } + ] + } + } + }, + "nologgingstacknologgingstackalias0D6EE5FC": { + "Type": "AWS::Route53::RecordSet", + "Properties": { + "Name": "www.example.com.", + "Type": "A", + "AliasTarget": { + "DNSName": { + "Fn::Join": [ + "", + [ + "dualstack.", + { + "Fn::GetAtt": [ + "nologgingstacknologgingstackalbFD11E34A", + "DNSName" + ] + } + ] + ] + }, + "HostedZoneId": { + "Fn::GetAtt": [ + "nologgingstacknologgingstackalbFD11E34A", + "CanonicalHostedZoneID" + ] + } + }, + "HostedZoneId": { + "Ref": "nologgingstacknologgingstackzoneE11B9175" + } + } + }, + "Vpc8378EB38": { + "Type": "AWS::EC2::VPC", + "Properties": { + "CidrBlock": "10.0.0.0/16", + "EnableDnsHostnames": true, + "EnableDnsSupport": true, + "InstanceTenancy": "default", + "Tags": [ + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc" + } + ] + } + }, + "VpcisolatedSubnet1SubnetE62B1B9B": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "10.0.0.0/18", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1a", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "isolated" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Isolated" + }, + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc/isolatedSubnet1" + } + ] + } + }, + "VpcisolatedSubnet1RouteTableE442650B": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc/isolatedSubnet1" + } + ] + } + }, + "VpcisolatedSubnet1RouteTableAssociationD259E31A": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcisolatedSubnet1RouteTableE442650B" + }, + "SubnetId": { + "Ref": "VpcisolatedSubnet1SubnetE62B1B9B" + } + } + }, + "VpcisolatedSubnet2Subnet39217055": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "10.0.64.0/18", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1b", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "isolated" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Isolated" + }, + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc/isolatedSubnet2" + } + ] + } + }, + "VpcisolatedSubnet2RouteTable334F9764": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc/isolatedSubnet2" + } + ] + } + }, + "VpcisolatedSubnet2RouteTableAssociation25A4716F": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcisolatedSubnet2RouteTable334F9764" + }, + "SubnetId": { + "Ref": "VpcisolatedSubnet2Subnet39217055" + } + } + }, + "VpcisolatedSubnet3Subnet44F2537D": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "10.0.128.0/18", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1c", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "isolated" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Isolated" + }, + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc/isolatedSubnet3" + } + ] + } + }, + "VpcisolatedSubnet3RouteTableA2F6BBC0": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc/isolatedSubnet3" + } + ] + } + }, + "VpcisolatedSubnet3RouteTableAssociationDC010BEB": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcisolatedSubnet3RouteTableA2F6BBC0" + }, + "SubnetId": { + "Ref": "VpcisolatedSubnet3Subnet44F2537D" + } + } + }, + "VpcFlowLogIAMRole6A475D41": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "vpc-flow-logs.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc" + } + ] + } + }, + "VpcFlowLogIAMRoleDefaultPolicy406FB995": { + "Type": "AWS::IAM::Policy", + "Properties": { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "logs:CreateLogStream", + "logs:PutLogEvents", + "logs:DescribeLogStreams" + ], + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogLogGroup7B5C56B9", + "Arn" + ] + } + }, + { + "Action": "iam:PassRole", + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + } + } + ], + "Version": "2012-10-17" + }, + "PolicyName": "VpcFlowLogIAMRoleDefaultPolicy406FB995", + "Roles": [ + { + "Ref": "VpcFlowLogIAMRole6A475D41" + } + ] + } + }, + "VpcFlowLogLogGroup7B5C56B9": { + "Type": "AWS::Logs::LogGroup", + "Properties": { + "RetentionInDays": 731 + }, + "UpdateReplacePolicy": "Retain", + "DeletionPolicy": "Retain", + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W84", + "reason": "By default CloudWatchLogs LogGroups data is encrypted using the CloudWatch server-side encryption keys (AWS Managed Keys)" + } + ] + } + } + }, + "VpcFlowLog8FF33A73": { + "Type": "AWS::EC2::FlowLog", + "Properties": { + "ResourceId": { + "Ref": "Vpc8378EB38" + }, + "ResourceType": "VPC", + "TrafficType": "ALL", + "DeliverLogsPermissionArn": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + }, + "LogDestinationType": "cloud-watch-logs", + "LogGroupName": { + "Ref": "VpcFlowLogLogGroup7B5C56B9" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc" + } + ] + } + } + }, + "Parameters": { + "BootstrapVersion": { + "Type": "AWS::SSM::Parameter::Value", + "Default": "/cdk-bootstrap/hnb659fds/version", + "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store." + } + }, + "Rules": { + "CheckBootstrapVersion": { + "Assertions": [ + { + "Assert": { + "Fn::Not": [ + { + "Fn::Contains": [ + [ + "1", + "2", + "3", + "4", + "5" + ], + { + "Ref": "BootstrapVersion" + } + ] + } + ] + }, + "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." + } + ] + } + } +} \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.ts new file mode 100644 index 000000000..bc4bcf94b --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.ts @@ -0,0 +1,45 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +// Imports +import { App, Stack, Aws } from "@aws-cdk/core"; +import { Route53ToAlb, Route53ToAlbProps } from "../lib"; +import { generateIntegStackName } from '@aws-solutions-constructs/core'; +import * as defaults from '@aws-solutions-constructs/core'; +import { CfnSecurityGroup } from "@aws-cdk/aws-ec2"; + +// Setup +const app = new App(); +const stack = new Stack(app, generateIntegStackName(__filename), { + env: { account: Aws.ACCOUNT_ID, region: 'us-east-1' }, +}); +stack.templateOptions.description = 'Integration Test for aws-route53-alb'; + +// Definitions +const props: Route53ToAlbProps = { + publicApi: false, + privateHostedZoneProps: { + zoneName: 'www.example.com' + }, + logAccessLogs: false, +}; + +const testConstruct = new Route53ToAlb(stack, 'no-logging-stack', props); + +const newSecurityGroup = testConstruct.loadBalancer.connections.securityGroups[0].node.defaultChild as CfnSecurityGroup; +defaults.addCfnSuppressRules(newSecurityGroup, [{ id: 'W29', reason: 'CDK created rule that blocks all traffic.'}]); + +defaults.addCfnSuppressRules(testConstruct.loadBalancer, [{ id: 'W52', reason: 'This test is explicitly to test the no logging case.'}]); + +// Synth +app.synth(); \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/route53-alb.test.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/route53-alb.test.ts new file mode 100644 index 000000000..2698936e9 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/route53-alb.test.ts @@ -0,0 +1,434 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +// Imports +import { Stack } from "@aws-cdk/core"; +import { Route53ToAlb, Route53ToAlbProps } from '../lib'; +import * as r53 from '@aws-cdk/aws-route53'; +import * as elb from '@aws-cdk/aws-elasticloadbalancingv2'; +import '@aws-cdk/assert/jest'; +import * as defaults from '@aws-solutions-constructs/core'; + +// Helper Functions + +function getTestVpc(stack: Stack) { + return defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + constructVpcProps: { + enableDnsHostnames: true, + enableDnsSupport: true, + cidr: '172.168.0.0/16', + }, + }); +} + +test('Test Public API, new VPC', () => { + // Initial Setup + const stack = new Stack(undefined, undefined, { + env: { account: "123456789012", region: 'us-east-1' }, + }); + + const newZone = new r53.PublicHostedZone(stack, 'test-zone', { + zoneName: 'www.example-test.com' + }); + + const props: Route53ToAlbProps = { + publicApi: true, + existingHostedZoneInterface: newZone, + }; + + new Route53ToAlb(stack, 'test-route53-alb', props); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Scheme: 'internet-facing' + }); + + expect(stack).toHaveResourceLike('AWS::EC2::VPC', { + EnableDnsHostnames: true, + EnableDnsSupport: true, + InstanceTenancy: "default", + }); + + expect(stack).toHaveResourceLike('AWS::Route53::RecordSet', { + Name: 'www.example-test.com.', + Type: 'A' + }); + +}); + +test('Test Private API, existing VPC', () => { + // Initial Setup + const stack = new Stack(undefined, undefined, { + env: { account: "123456789012", region: 'us-east-1' }, + }); + + const testExistingVpc = getTestVpc(stack); + + const newZone = new r53.PrivateHostedZone(stack, 'test-zone', { + zoneName: 'www.example-test.com', + vpc: testExistingVpc + }); + + const props: Route53ToAlbProps = { + publicApi: false, + existingHostedZoneInterface: newZone, + existingVpc: testExistingVpc + }; + + new Route53ToAlb(stack, 'test-route53-alb', props); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Scheme: 'internal' + }); + + expect(stack).toHaveResourceLike('AWS::EC2::VPC', { + EnableDnsHostnames: true, + EnableDnsSupport: true, + InstanceTenancy: "default", + }); + + expect(stack).toHaveResourceLike('AWS::Route53::RecordSet', { + Name: 'www.example-test.com.', + Type: 'A' + }); + +}); + +test('Test Private API, new VPC', () => { + // Initial Setup + const stack = new Stack(undefined, undefined, { + env: { account: "123456789012", region: 'us-east-1' }, + }); + + const props: Route53ToAlbProps = { + publicApi: false, + privateHostedZoneProps: { + zoneName: 'www.example-test.com', + } + }; + + new Route53ToAlb(stack, 'test-route53-alb', props); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Scheme: 'internal' + }); + + expect(stack).toHaveResourceLike('AWS::EC2::VPC', { + EnableDnsHostnames: true, + EnableDnsSupport: true, + InstanceTenancy: "default", + }); + + expect(stack).toHaveResourceLike('AWS::Route53::RecordSet', { + Name: 'www.example-test.com.', + Type: 'A' + }); + +}); + +test('Check publicApi and zone props is an error', () => { + // Initial Setup + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const props: Route53ToAlbProps = { + publicApi: true, + existingVpc: testExistingVpc, + privateHostedZoneProps: { + zoneName: 'www.example-test.com', + } + }; + + const app = () => { + new Route53ToAlb(stack, 'test-error', props); + }; + // Assertion + expect(app).toThrowError(); +}); + +test('Check no Zone props and no existing zone interface is an error', () => { + // Initial Setup + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const props: Route53ToAlbProps = { + publicApi: false, + existingVpc: testExistingVpc, + }; + + const app = () => { + new Route53ToAlb(stack, 'test-error', props); + }; + // Assertion + expect(app).toThrowError(); +}); + +test('Check Zone props with VPC is an error', () => { + // Initial Setup + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const props: Route53ToAlbProps = { + publicApi: false, + existingVpc: testExistingVpc, + privateHostedZoneProps: { + zoneName: 'www.example-test.com', + vpc: testExistingVpc + } + }; + + const app = () => { + new Route53ToAlb(stack, 'test-error', props); + }; + // Assertion + expect(app).toThrowError(); + +}); + +test('Test with privateHostedZoneProps', () => { + // Initial Setup + const stack = new Stack(undefined, undefined, { + env: { account: "123456789012", region: 'us-east-1' }, + }); + + const testExistingVpc = getTestVpc(stack); + + const props: Route53ToAlbProps = { + publicApi: false, + existingVpc: testExistingVpc, + privateHostedZoneProps: { + zoneName: 'www.example-test.com', + } + }; + + new Route53ToAlb(stack, 'test-error', props); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Scheme: 'internal' + }); + + expect(stack).toHaveResourceLike('AWS::EC2::VPC', { + EnableDnsHostnames: true, + EnableDnsSupport: true, + InstanceTenancy: "default", + }); + + expect(stack).toHaveResourceLike('AWS::Route53::RecordSet', { + Name: 'www.example-test.com.', + Type: 'A' + }); +}); + +test('Check that passing an existing hosted Zone without passing an existingVPC is an error', () => { + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const newZone = new r53.PrivateHostedZone(stack, 'test-zone', { + zoneName: 'www.example-test.com', + vpc: testExistingVpc + }); + + const props: Route53ToAlbProps = { + publicApi: false, + existingHostedZoneInterface: newZone, + }; + + const app = () => { + new Route53ToAlb(stack, 'test-error', props); + }; + // Assertion + expect(app).toThrowError(); + +}); + +test('Check that passing an existing Load Balancer without passing an existingVPC is an error', () => { + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const existingAlb = new elb.ApplicationLoadBalancer(stack, 'test-alb', { + vpc: testExistingVpc + }); + + const props: Route53ToAlbProps = { + publicApi: false, + existingLoadBalancerObj: existingAlb, + privateHostedZoneProps: { + zoneName: 'www.example-test.com', + } + }; + + const app = () => { + new Route53ToAlb(stack, 'test-error', props); + }; + // Assertion + expect(app).toThrowError(); + +}); + +test('Check that passing an existing ALB without passing an existingVPC is an error', () => { + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const newZone = new r53.PrivateHostedZone(stack, 'test-zone', { + zoneName: 'www.example-test.com', + vpc: testExistingVpc + }); + + const props: Route53ToAlbProps = { + publicApi: false, + existingHostedZoneInterface: newZone, + }; + + const app = () => { + new Route53ToAlb(stack, 'test-error', props); + }; + // Assertion + expect(app).toThrowError(); + +}); + +test('Check that passing loadBalancerProps with a vpc is an error', () => { + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const newZone = new r53.PrivateHostedZone(stack, 'test-zone', { + zoneName: 'www.example-test.com', + vpc: testExistingVpc + }); + + const props: Route53ToAlbProps = { + publicApi: false, + existingHostedZoneInterface: newZone, + loadBalancerProps: { + loadBalancerName: 'my-alb', + vpc: testExistingVpc, + } + }; + + const app = () => { + new Route53ToAlb(stack, 'test-error', props); + }; + // Assertion + expect(app).toThrowError(); + +}); + +test('Test providing loadBalancerProps', () => { + // Initial Setup + const stack = new Stack(undefined, undefined, { + env: { account: "123456789012", region: 'us-east-1' }, + }); + + const testExistingVpc = getTestVpc(stack); + + const newZone = new r53.PrivateHostedZone(stack, 'test-zone', { + zoneName: 'www.example-test.com', + vpc: testExistingVpc + }); + + const props: Route53ToAlbProps = { + publicApi: false, + existingHostedZoneInterface: newZone, + existingVpc: testExistingVpc, + loadBalancerProps: { + loadBalancerName: 'find-this-name' + }, + }; + + new Route53ToAlb(stack, 'test-route53-alb', props); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Scheme: 'internal', + Name: 'find-this-name' + }); + + expect(stack).toHaveResourceLike('AWS::EC2::VPC', { + EnableDnsHostnames: true, + EnableDnsSupport: true, + InstanceTenancy: "default", + }); + + expect(stack).toHaveResourceLike('AWS::Route53::RecordSet', { + Name: 'www.example-test.com.', + Type: 'A' + }); + +}); + +test('Test providing an existingLoadBalancer', () => { + // Initial Setup + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const newZone = new r53.PrivateHostedZone(stack, 'test-zone', { + zoneName: 'www.example-test.com', + vpc: testExistingVpc + }); + + const existingAlb = new elb.ApplicationLoadBalancer(stack, 'test-alb', { + vpc: testExistingVpc, + loadBalancerName: 'find-this-name' + }); + + const props: Route53ToAlbProps = { + publicApi: false, + existingHostedZoneInterface: newZone, + existingVpc: testExistingVpc, + existingLoadBalancerObj: existingAlb, + }; + + new Route53ToAlb(stack, 'test-route53-alb', props); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Scheme: 'internal', + Name: 'find-this-name' + }); + + expect(stack).toHaveResourceLike('AWS::EC2::VPC', { + EnableDnsHostnames: true, + EnableDnsSupport: true, + InstanceTenancy: "default", + }); + + expect(stack).toHaveResourceLike('AWS::Route53::RecordSet', { + Name: 'www.example-test.com.', + Type: 'A' + }); + +}); + +test('Check publicApi and without an existing hosted zone is an error', () => { + // Initial Setup + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const props: Route53ToAlbProps = { + publicApi: true, + existingVpc: testExistingVpc, + }; + + const app = () => { + new Route53ToAlb(stack, 'test-error', props); + }; + // Assertion + expect(app).toThrowError(); +}); diff --git a/source/patterns/@aws-solutions-constructs/core/index.ts b/source/patterns/@aws-solutions-constructs/core/index.ts index 1a22a80fc..2d4b451df 100644 --- a/source/patterns/@aws-solutions-constructs/core/index.ts +++ b/source/patterns/@aws-solutions-constructs/core/index.ts @@ -11,6 +11,8 @@ * and limitations under the License. */ +export * from './lib/alb-defaults'; +export * from './lib/alb-helper'; export * from './lib/apigateway-defaults'; export * from './lib/apigateway-helper'; export * from './lib/dynamodb-table-defaults'; diff --git a/source/patterns/@aws-solutions-constructs/core/lib/alb-defaults.ts b/source/patterns/@aws-solutions-constructs/core/lib/alb-defaults.ts new file mode 100644 index 000000000..5659e534f --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/core/lib/alb-defaults.ts @@ -0,0 +1,21 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +import * as elb from "@aws-cdk/aws-elasticloadbalancingv2"; + +export function DefaultListenerProps(loadBalancer: elb.ApplicationLoadBalancer): elb.ApplicationListenerProps { + return { + loadBalancer, + protocol: elb.ApplicationProtocol.HTTPS, + }; +} \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/core/lib/alb-helper.ts b/source/patterns/@aws-solutions-constructs/core/lib/alb-helper.ts new file mode 100644 index 000000000..7034fbfba --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/core/lib/alb-helper.ts @@ -0,0 +1,152 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +import * as elb from "@aws-cdk/aws-elasticloadbalancingv2"; +import { Construct } from "@aws-cdk/core"; +import * as ec2 from "@aws-cdk/aws-ec2"; +import * as s3 from "@aws-cdk/aws-s3"; +import * as lambda from "@aws-cdk/aws-lambda"; +import { ApplicationProtocol, ListenerAction, } from "@aws-cdk/aws-elasticloadbalancingv2"; +import * as elbt from "@aws-cdk/aws-elasticloadbalancingv2-targets"; +import { overrideProps, printWarning } from "./utils"; +import { DefaultListenerProps } from "./alb-defaults"; +import { createAlbLoggingBucket } from "./s3-bucket-helper"; +import { DefaultLoggingBucketProps } from "./s3-bucket-defaults"; + +// Returns the correct ALB Load Balancer to use in this construct, either an existing +// one provided as an argument or create new one otherwise. +export function ObtainAlb( + scope: Construct, + id: string, + vpc: ec2.IVpc, + publicApi: boolean, + existingLoadBalancerInterface?: elb.ApplicationLoadBalancer, + loadBalancerProps?: elb.ApplicationLoadBalancerProps | any, + logAccessLogs?: boolean, + loggingBucketProps?: s3.BucketProps +): elb.ApplicationLoadBalancer { + let loadBalancer: elb.ApplicationLoadBalancer; + + if (existingLoadBalancerInterface) { + loadBalancer = existingLoadBalancerInterface; + } else { + const consolidatedProps = loadBalancerProps + ? overrideProps(loadBalancerProps, { vpc, internetFacing: publicApi }) + : { vpc, internetFacing: publicApi }; + loadBalancer = new elb.ApplicationLoadBalancer( + scope, + `${id}-alb`, + consolidatedProps + ); + if (logAccessLogs === undefined || logAccessLogs === true) { + const consolidatedLoggingBucketProps = loggingBucketProps + ? overrideProps(DefaultLoggingBucketProps(), loggingBucketProps) + : DefaultLoggingBucketProps(); + const loggingBucket = createAlbLoggingBucket(scope, id, consolidatedLoggingBucketProps); + loadBalancer.logAccessLogs(loggingBucket); + } + } + return loadBalancer; +} + +export function AddListener( + scope: Construct, + loadBalancer: elb.ApplicationLoadBalancer, + targetGroup: elb.ApplicationTargetGroup, + listenerProps: elb.ApplicationListenerProps | any +): elb.ApplicationListener { + let consolidatedListenerProps: elb.ApplicationListenerProps; + + consolidatedListenerProps = overrideProps( + DefaultListenerProps(loadBalancer), + listenerProps + ); + + // create the listener + const listener = new elb.ApplicationListener( + scope, + "listener", + consolidatedListenerProps + ); + loadBalancer.listeners.push(listener); + + if (consolidatedListenerProps.protocol === elb.ApplicationProtocol.HTTP) { + // This will use core.printWarning in the actual construct + printWarning( + "AWS recommends encrypting traffic to an Application Load Balancer using HTTPS." + ); + if (listenerProps.certificates?.length > 0) { + throw new Error("HTTP listeners cannot use a certificate"); + } + } else { + if (!listenerProps.certificates || listenerProps.certificates.length === 0) { + throw new Error("A listener using HTTPS protocol requires a certificate"); + } + + listener.addCertificates("listener-cert-add", listenerProps.certificates); + } + + if (consolidatedListenerProps.protocol === elb.ApplicationProtocol.HTTPS) { + const opt: elb.RedirectOptions = { + port: "443", + protocol: "HTTPS", + }; + + const httpListener = new elb.ApplicationListener( + scope, + "redirect-listener", + { + loadBalancer, + protocol: ApplicationProtocol.HTTP, + defaultAction: ListenerAction.redirect(opt), + } + ); + loadBalancer.listeners.push(httpListener); + } + + AddTarget(scope, targetGroup, listener); + return listener; +} + +export function CreateLambdaTargetGroup( + scope: Construct, + id: string, + lambdaFunction: lambda.IFunction, + targetProps?: elb.ApplicationTargetGroupProps +): elb.ApplicationTargetGroup { + const lambdaTarget = new elbt.LambdaTarget(lambdaFunction); + return new elb.ApplicationTargetGroup(scope, `${id}-tg`, { + targets: [lambdaTarget], + targetGroupName: targetProps ? targetProps.targetGroupName : undefined, + healthCheck: targetProps ? targetProps.healthCheck : undefined + }); +} + +export function AddTarget( + scope: Construct, + targetGroup: elb.ApplicationTargetGroup, + listener: elb.ApplicationListener, + ruleProps?: elb.AddRuleProps +) { + // AddRuleProps includes conditions and priority, combine that with targetGroups and + // we can assemble AddApplicationTargetGroupProps + if (ruleProps) { + const consolidatedTargetProps = overrideProps(ruleProps, { targetGroups: [targetGroup] }); + listener.addTargetGroups(`${scope.node.id}-targets`, consolidatedTargetProps); + } else { + listener.addTargetGroups("targets", { + targetGroups: [targetGroup], + }); + } + return; +} diff --git a/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-defaults.ts b/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-defaults.ts index 2ce73bea4..2a7c5c476 100644 --- a/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-defaults.ts +++ b/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-defaults.ts @@ -26,5 +26,14 @@ export function DefaultS3Props(loggingBucket ?: Bucket, lifecycleRules?: s3.Life } as BucketProps; } +export function DefaultLoggingBucketProps(): s3.BucketProps { + return { + encryption: s3.BucketEncryption.S3_MANAGED, + versioned: true, + blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL, + removalPolicy: RemovalPolicy.RETAIN, + } as BucketProps; +} + // Default event types to trigger S3 notifications export const defaultS3NotificationEventTypes = [s3.EventType.OBJECT_CREATED]; diff --git a/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-helper.ts b/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-helper.ts index d65c9ca8e..5c56a15ad 100644 --- a/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-helper.ts +++ b/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-helper.ts @@ -100,6 +100,28 @@ export function createLoggingBucket(scope: Construct, return loggingBucket; } +export function createAlbLoggingBucket(scope: Construct, + bucketId: string, + loggingBucketProps: s3.BucketProps): s3.Bucket { + + // Create the Logging Bucket + const loggingBucket: s3.Bucket = new s3.Bucket(scope, bucketId, loggingBucketProps); + + applySecureBucketPolicy(loggingBucket); + + // Extract the CfnBucket from the loggingBucket + const loggingBucketResource = loggingBucket.node.findChild('Resource') as s3.CfnBucket; + + addCfnSuppressRules(loggingBucketResource, [ + { + id: 'W35', + reason: "This is a log bucket for an Application Load Balancer" + } + ]); + + return loggingBucket; +} + function s3BucketWithLogging(scope: Construct, s3BucketProps?: s3.BucketProps, bucketId?: string, diff --git a/source/patterns/@aws-solutions-constructs/core/package.json b/source/patterns/@aws-solutions-constructs/core/package.json index 689afee3d..a65fab13b 100644 --- a/source/patterns/@aws-solutions-constructs/core/package.json +++ b/source/patterns/@aws-solutions-constructs/core/package.json @@ -55,6 +55,8 @@ "@aws-cdk/aws-cloudfront": "0.0.0", "@aws-cdk/aws-cloudfront-origins": "0.0.0", "@aws-cdk/aws-dynamodb": "0.0.0", + "@aws-cdk/aws-elasticloadbalancingv2": "0.0.0", + "@aws-cdk/aws-elasticloadbalancingv2-targets": "0.0.0", "@aws-cdk/aws-glue": "0.0.0", "@aws-cdk/aws-iot": "0.0.0", "@aws-cdk/aws-kinesis": "0.0.0", diff --git a/source/patterns/@aws-solutions-constructs/core/test/alb-helper.test.ts b/source/patterns/@aws-solutions-constructs/core/test/alb-helper.test.ts new file mode 100644 index 000000000..8e8a504cc --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/core/test/alb-helper.test.ts @@ -0,0 +1,390 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +import { Stack } from '@aws-cdk/core'; +import * as elb from "@aws-cdk/aws-elasticloadbalancingv2"; +import * as acm from "@aws-cdk/aws-certificatemanager"; +import * as lambda from "@aws-cdk/aws-lambda"; +import * as defaults from '../index'; +import '@aws-cdk/assert/jest'; + +test('Test ObtainAlb with existing ALB', () => { + const stack = new Stack(); + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + const existingLoadBalancer = new elb.ApplicationLoadBalancer(stack, 'load-balancer', { + vpc, + internetFacing: true, + loadBalancerName: 'unique-name' + }); + + defaults.ObtainAlb(stack, 'test', vpc, true, existingLoadBalancer); + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Name: "unique-name", + }); +}); + +test('Test ObtainAlb for new ALB with provided props', () => { + const stack = new Stack(undefined, undefined, { + env: { account: "123456789012", region: 'us-east-1' }, + }); + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + defaults.ObtainAlb(stack, 'test', vpc, true, undefined, { + loadBalancerName: 'new-loadbalancer', + vpc, + internetFacing: true + }); + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Name: "new-loadbalancer", + Scheme: "internet-facing", + }); +}); + +test('Test ObtainAlb for new ALB with default props', () => { + const stack = new Stack(undefined, undefined, { + env: { account: "123456789012", region: 'us-east-1' }, + }); + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + defaults.ObtainAlb(stack, 'test', vpc, false); + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Scheme: "internal", + }); +}); + +test('Test ObtainAlb for new ALB with default props', () => { + const stack = new Stack(); + + const testFunction = new lambda.Function(stack, 'test-function', { + code: lambda.Code.fromAsset(`${__dirname}/lambda`), + runtime: lambda.Runtime.NODEJS_14_X, + handler: "index.handler", + }); + + defaults.CreateLambdaTargetGroup(stack, 'test-target', testFunction); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::TargetGroup', { + TargetType: "lambda" + }); +}); + +test('Test ObtainAlb for new ALB with custom props', () => { + const stack = new Stack(); + + const testFunction = new lambda.Function(stack, 'test-function', { + code: lambda.Code.fromAsset(`${__dirname}/lambda`), + runtime: lambda.Runtime.NODEJS_14_X, + handler: "index.handler", + }); + + defaults.CreateLambdaTargetGroup(stack, 'test-target', testFunction, { + targetGroupName: 'test-target-group' + }); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::TargetGroup', { + TargetType: "lambda", + Name: 'test-target-group' + }); +}); + +test('Test Add Target without ruleProps', () => { + const stack = new Stack(); + + const testFunction = new lambda.Function(stack, 'test-function', { + code: lambda.Code.fromAsset(`${__dirname}/lambda`), + runtime: lambda.Runtime.NODEJS_14_X, + handler: "index.handler", + }); + + const targetGroup = defaults.CreateLambdaTargetGroup(stack, 'test-target', testFunction, { + targetGroupName: 'test-target-group' + }); + + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + const existingLoadBalancer = new elb.ApplicationLoadBalancer(stack, 'load-balancer', { + vpc, + internetFacing: true, + loadBalancerName: 'unique-name' + }); + + const testListener = new elb.ApplicationListener(stack, 'test-listener', { + loadBalancer: existingLoadBalancer, + protocol: elb.ApplicationProtocol.HTTP + }); + + defaults.AddTarget(stack, targetGroup, testListener); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::Listener', { + DefaultActions: [ + { + TargetGroupArn: { + Ref: "testtargettgB2EE41CA" + }, + Type: "forward" + } + ], + }); +}); + +test('Test Add Target with ruleProps', () => { + const stack = new Stack(); + + const testFunction = new lambda.Function(stack, 'test-function', { + code: lambda.Code.fromAsset(`${__dirname}/lambda`), + runtime: lambda.Runtime.NODEJS_14_X, + handler: "index.handler", + }); + + const targetGroup = defaults.CreateLambdaTargetGroup(stack, 'test-target', testFunction, { + targetGroupName: 'test-target-group' + }); + + const secondTargetGroup = defaults.CreateLambdaTargetGroup(stack, 'second-target', testFunction, { + targetGroupName: 'second-target-group' + }); + + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + const existingLoadBalancer = new elb.ApplicationLoadBalancer(stack, 'load-balancer', { + vpc, + internetFacing: true, + loadBalancerName: 'unique-name' + }); + + const testListener = new elb.ApplicationListener(stack, 'test-listener', { + loadBalancer: existingLoadBalancer, + protocol: elb.ApplicationProtocol.HTTP + }); + + // The first target is default and can't have rules, so + // we need to add 2 targets + defaults.AddTarget(stack, targetGroup, testListener); + defaults.AddTarget(stack, secondTargetGroup, testListener, { + conditions: [elb.ListenerCondition.pathPatterns(["*admin*"])], + priority: 10 + }); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::ListenerRule', { + Actions: [ + { + TargetGroupArn: { + Ref: "secondtargettg0CE37E1F" + }, + Type: "forward" + } + ], + Conditions: [ + { + Field: "path-pattern", + PathPatternConfig: { + Values: [ + "*admin*" + ] + } + } + ] + }); +}); + +test('Test AddListener with defaults', () => { + const stack = new Stack(); + const testFunction = new lambda.Function(stack, 'test-function', { + code: lambda.Code.fromAsset(`${__dirname}/lambda`), + runtime: lambda.Runtime.NODEJS_14_X, + handler: "index.handler", + }); + + const targetGroup = defaults.CreateLambdaTargetGroup(stack, 'test-target', testFunction, { + targetGroupName: 'test-target-group' + }); + + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + const existingLoadBalancer = new elb.ApplicationLoadBalancer(stack, 'load-balancer', { + vpc, + internetFacing: true, + loadBalancerName: 'unique-name' + }); + + const cert = acm.Certificate.fromCertificateArn( + stack, + 'not-really-a-cert', + "arn:aws:acm:us-east-1:123456789012:certificate/85c52dc8-1b37-4afd-a7aa-f03aac2db0cc" + ); + + defaults.AddListener(stack, existingLoadBalancer, targetGroup, { + certificates: [ cert ], + }); + + // This should create 2 listeners, HTTPS plus redirect of HTTP + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::Listener', { + Protocol: 'HTTPS', + }); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::Listener', { + Protocol: 'HTTP', + }); +}); + +test('Test AddListener with no cert for an HTTPS listener', () => { + const stack = new Stack(); + const testFunction = new lambda.Function(stack, 'test-function', { + code: lambda.Code.fromAsset(`${__dirname}/lambda`), + runtime: lambda.Runtime.NODEJS_14_X, + handler: "index.handler", + }); + + const targetGroup = defaults.CreateLambdaTargetGroup(stack, 'test-target', testFunction, { + targetGroupName: 'test-target-group' + }); + + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + const existingLoadBalancer = new elb.ApplicationLoadBalancer(stack, 'load-balancer', { + vpc, + internetFacing: true, + loadBalancerName: 'unique-name' + }); + + const app = () => { + defaults.AddListener(stack, existingLoadBalancer, targetGroup, {}); + }; + expect(app).toThrowError(); +}); + +test('Test AddListener error for HTTP with a cert', () => { + const stack = new Stack(); + const testFunction = new lambda.Function(stack, 'test-function', { + code: lambda.Code.fromAsset(`${__dirname}/lambda`), + runtime: lambda.Runtime.NODEJS_14_X, + handler: "index.handler", + }); + + const targetGroup = defaults.CreateLambdaTargetGroup(stack, 'test-target', testFunction, { + targetGroupName: 'test-target-group' + }); + + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + const existingLoadBalancer = new elb.ApplicationLoadBalancer(stack, 'load-balancer', { + vpc, + internetFacing: true, + loadBalancerName: 'unique-name' + }); + + const cert = acm.Certificate.fromCertificateArn( + stack, + 'not-really-a-cert', + "arn:aws:acm:us-east-1:123456789012:certificate/85c52dc8-1b37-4afd-a7aa-f03aac2db0cc" + ); + + const app = () => { + defaults.AddListener(stack, existingLoadBalancer, targetGroup, { + certificates: [ cert ], + protocol: elb.ApplicationProtocol.HTTP, + }); + }; + expect(app).toThrowError(); + +}); + +test('Test AddListener for HTTP Listener', () => { + const stack = new Stack(); + const testFunction = new lambda.Function(stack, 'test-function', { + code: lambda.Code.fromAsset(`${__dirname}/lambda`), + runtime: lambda.Runtime.NODEJS_14_X, + handler: "index.handler", + }); + + const targetGroup = defaults.CreateLambdaTargetGroup(stack, 'test-target', testFunction, { + targetGroupName: 'test-target-group' + }); + + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + const existingLoadBalancer = new elb.ApplicationLoadBalancer(stack, 'load-balancer', { + vpc, + internetFacing: true, + loadBalancerName: 'unique-name' + }); + + defaults.AddListener(stack, existingLoadBalancer, targetGroup, { + protocol: elb.ApplicationProtocol.HTTP, + }); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::Listener', { + Protocol: 'HTTP', + }); + expect(stack).not.toHaveResourceLike('AWS::ElasticLoadBalancingV2::Listener', { + Protocol: 'HTTPS', + }); +}); + +test('Test with custom logging bucket props', () => { + // Creating ALB logging requires a region and account (but + // these can be fake in unit tests) + const stack = new Stack(undefined, undefined, { + env: { account: "123456789012", region: 'us-east-1' }, + }); + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + const testName = 'test-name'; + + defaults.ObtainAlb(stack, 'test', vpc, false, undefined, undefined, true, { bucketName: testName }); + expect(stack).toHaveResourceLike('AWS::S3::Bucket', { + BucketName: testName + }); +}); + +test('Test with no logging', () => { + const stack = new Stack(); + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + defaults.ObtainAlb(stack, 'test', vpc, false, undefined, undefined, false); + expect(stack).not.toHaveResourceLike('AWS::S3::Bucket', {}); +}); diff --git a/source/patterns/@aws-solutions-constructs/core/test/s3-bucket.test.ts b/source/patterns/@aws-solutions-constructs/core/test/s3-bucket.test.ts index 513fda070..996dc03f3 100644 --- a/source/patterns/@aws-solutions-constructs/core/test/s3-bucket.test.ts +++ b/source/patterns/@aws-solutions-constructs/core/test/s3-bucket.test.ts @@ -142,3 +142,15 @@ test('test s3Bucket override serverAccessLogsBucket', () => { } }); }); + +test('test createAlbLoggingBucket()', () => { + const stack = new Stack(); + + defaults.createAlbLoggingBucket(stack, 'test-bucket', { + bucketName: 'test-name' + }); + + expect(stack).toHaveResource("AWS::S3::Bucket", { + BucketName: 'test-name' + }); +});