From 518aa49205d15094b70dc6f56649e27fafbe2331 Mon Sep 17 00:00:00 2001 From: biffgaut <78155736+biffgaut@users.noreply.github.com> Date: Tue, 5 Oct 2021 16:02:52 -0400 Subject: [PATCH 01/14] Implement new construct --- .../aws-route53-alb/.eslintignore | 4 + .../aws-route53-alb/.gitignore | 15 + .../aws-route53-alb/.npmignore | 21 + .../aws-route53-alb/README.md | 99 ++ .../aws-route53-alb/architecture.png | Bin 0 -> 55118 bytes .../aws-route53-alb/lib/index.ts | 175 ++++ .../aws-route53-alb/package.json | 109 ++ .../test/integ.deployPrivateApi.expected.json | 551 +++++++++++ .../test/integ.deployPrivateApi.ts | 37 + ...deployPrivateApiExistingZone.expected.json | 930 ++++++++++++++++++ .../integ.deployPrivateApiExistingZone.ts | 52 + ...g.deployPublicApiExistingAlb.expected.json | 779 +++++++++++++++ .../test/integ.deployPublicApiExistingAlb.ts | 58 ++ .../integ.deployPublicApiNewAlb.expected.json | 926 +++++++++++++++++ .../test/integ.deployPublicApiNewAlb.ts | 54 + .../integ.deployWithoutLogging.expected.json | 407 ++++++++ .../test/integ.deployWithoutLogging.ts | 38 + .../aws-route53-alb/test/route53-alb.test.ts | 384 ++++++++ .../@aws-solutions-constructs/core/index.ts | 2 + .../core/lib/alb-defaults.ts | 21 + .../core/lib/alb-helper.ts | 152 +++ .../core/lib/s3-bucket-defaults.ts | 9 + .../core/lib/s3-bucket-helper.ts | 22 + .../core/package.json | 2 + .../core/test/alb-helper.test.ts | 390 ++++++++ .../core/test/s3-bucket.test.ts | 12 + 26 files changed, 5249 insertions(+) create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/.eslintignore create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/.gitignore create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/.npmignore create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/README.md create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/architecture.png create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/lib/index.ts create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/package.json create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.expected.json create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.ts create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.expected.json create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.ts create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.expected.json create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.ts create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.expected.json create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.ts create mode 100644 source/patterns/@aws-solutions-constructs/aws-route53-alb/test/route53-alb.test.ts create mode 100644 source/patterns/@aws-solutions-constructs/core/lib/alb-defaults.ts create mode 100644 source/patterns/@aws-solutions-constructs/core/lib/alb-helper.ts create mode 100644 source/patterns/@aws-solutions-constructs/core/test/alb-helper.test.ts diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/.eslintignore b/source/patterns/@aws-solutions-constructs/aws-route53-alb/.eslintignore new file mode 100644 index 000000000..e6f7801ea --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/.eslintignore @@ -0,0 +1,4 @@ +lib/*.js +test/*.js +*.d.ts +coverage diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/.gitignore b/source/patterns/@aws-solutions-constructs/aws-route53-alb/.gitignore new file mode 100644 index 000000000..6773cabd2 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/.gitignore @@ -0,0 +1,15 @@ +lib/*.js +test/*.js +*.js.map +*.d.ts +node_modules +*.generated.ts +dist +.jsii + +.LAST_BUILD +.nyc_output +coverage +.nycrc +.LAST_PACKAGE +*.snk \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/.npmignore b/source/patterns/@aws-solutions-constructs/aws-route53-alb/.npmignore new file mode 100644 index 000000000..f66791629 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/.npmignore @@ -0,0 +1,21 @@ +# Exclude typescript source and config +*.ts +tsconfig.json +coverage +.nyc_output +*.tgz +*.snk +*.tsbuildinfo + +# Include javascript files and typescript declarations +!*.js +!*.d.ts + +# Exclude jsii outdir +dist + +# Include .jsii +!.jsii + +# Include .jsii +!.jsii \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/README.md b/source/patterns/@aws-solutions-constructs/aws-route53-alb/README.md new file mode 100644 index 000000000..295318507 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/README.md @@ -0,0 +1,99 @@ +# aws-route53-alb module + + +--- + +![Stability: Experimental](https://img.shields.io/badge/stability-Experimental-important.svg?style=for-the-badge) + +> All classes are under active development and subject to non-backward compatible changes or removal in any +> future version. These are not subject to the [Semantic Versioning](https://semver.org/) model. +> This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package. + +--- + + +| **Reference Documentation**:| https://docs.aws.amazon.com/solutions/latest/constructs/| +|:-------------|:-------------| +
+ +| **Language** | **Package** | +|:-------------|-----------------| +|![Python Logo](https://docs.aws.amazon.com/cdk/api/latest/img/python32.png) Python|`aws_solutions_constructs.aws_route53_alb`| +|![Typescript Logo](https://docs.aws.amazon.com/cdk/api/latest/img/typescript32.png) Typescript|`@aws-solutions-constructs/aws-route53-alb`| +|![Java Logo](https://docs.aws.amazon.com/cdk/api/latest/img/java32.png) Java|`software.amazon.awsconstructs.services.route53alb`| + +This AWS Solutions Construct implements an Amazon Route53 Hosted Zone routing to an Application Load Balancer + +Here is a minimal deployable pattern definition in Typescript: + +``` typescript +import { Route53ToAlb } from '@aws-solutions-constructs/aws-route53-alb'; + +new Route53ToAlb(this, 'Route53ToAlbPattern', { + privateHostedZoneProps: { + zoneName: 'www.example.com', + } + publicApi: false, +}); + +``` + +## Initializer + +``` text +new Route53ToAlb(scope: Construct, id: string, props: Route53ToAlbProps); +``` + +_Parameters_ + +* scope [`Construct`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_core.Construct.html) +* id `string` +* props [`Route53ToAlbProps`](#pattern-construct-props) + +## Pattern Construct Props + // If no existingHostedZone, must send hostedZoneProps with at least zoneName + // Public APIs require an existing Hosted Zone to be passed in as the amount of + // DNS configuration required can't use any defaults and require a complex + // Construct hierarchy to define - at that point the client should just instantiate it. + // Private APIs can accept props and create a new Private Hosted Zone. + + + // drives multiple settings in construct, including + // alb.internetFacing and hostedZone creation + // This is a construct level attribute, define it here and not + // at lower level service props + +| **Name** | **Type** | **Description** | +|:-------------|:----------------|-----------------| +| privateHostedZoneProps? | [route53.PrivateHostedZoneProps](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-route53.PrivateHostedZoneProps.html) | Optional custom properties for a new Private Hosted Zone. Cannot be specified for a public API. Cannot specify a VPC, it will use the VPC in existingVpc or the VPC created by the construct. Providing both this and existingHostedZoneInterfaceis an error. | +| existingHostedZoneInterface? | [route53.IHostedZone](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-route53.IHostedZone.html) | Existing Public or Private Hosted Zone (type must match publicApi setting). Specifying both this and privateHostedZoneProps is an error. If this is a Private Hosted Zone, the associated VPC must be provided as the existingVpc property | +| loadBalancerProps? | [elasticloadbalancingv2.ApplicationLoadBalancerProps](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancerProps.html) | Optional custom properties for a new loadBalancer. Providing both this and existingLoadBalancer is an error. This cannot specify a VPC, it will use the VPC in existingVpc or the VPC created by the construct. | +| existingLoadBalancerObj? | [elasticloadbalancingv2.ApplicationLoadBalancer](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html) | Existing Application Load Balancer to incorporate into the construct architecture. Providing both this and loadBalancerProps is an error. The VPC containing this loadBalancer must match the VPC provided in existingVpc. | +| vpcProps? | [ec2.VpcProps](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-ec2.VpcProps.html) | Optional custom properties for a VPC the construct will create. This VPC will be used by the new ALB and any Private Hosted Zone the construct creates (that's why loadBalancerProps and privateHostedZoneProps can't include a VPC). Providing both this and existingVpc is an error. | +| existingVpc? | [ec2.IVpc](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-ec2.IVpc.html) | An existing VPC in which to deploy the construct. Providing both this and vpcProps is an error. If the client provides an existing load balancer and/or existing Private Hosted Zone, those constructs must exist in this VPC. | +| publicApi | boolean | Whether the construct is deploying a private or public API. This has implications for the Hosted Zone, VPC and ALB. | + + +## Pattern Properties + +| **Name** | **Type** | **Description** | +|:-------------|:----------------|-----------------| +| hostedZone | [route53.IHostedZone](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-route53.IHostedZone.html) | The hosted zone used by the construct (whether created by the construct or providedb by the client) | +| vpc | [ec2.IVpc](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-ec2.IVpc.html) | The VPC used by the construct (whether created by the construct or providedb by the client) | +| loadBalancer | [elasticloadbalancingv2.ApplicationLoadBalancer](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html) | The Load Balancer used by the construct (whether created by the construct or providedb by the client) | + +## Default settings + +Out of the box implementation of the Construct without any override will set the following defaults: + +### Amazon Route53 +* Adds an ALIAS record to the new or provided Hosted Zone that routes to the construct's ALB + +### Application Load Balancer +* Creates an Application Load Balancer with no Listener or target. The consruct can incorporate an existing, fully configured ALB if provided. + +## Architecture +![Architecture Diagram](architecture.png) + +*** +© Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/architecture.png b/source/patterns/@aws-solutions-constructs/aws-route53-alb/architecture.png new file mode 100644 index 0000000000000000000000000000000000000000..0a2858f5d019bf39903639de92e86eb24baafcc9 GIT binary patch literal 55118 zcmeFZg;yJ0*FFpsm*P^~wYa-m@#1d9in~K`cb7te0;R>>EkFvz9RdU`8l2$pLFPRS%qwLW7&vic#FrcyBYg)L z7+4uQX=!yuX=zGzH)m@*2P+sD#uQ64GaSXYj6coI&CGs|u`r>!dB2a2j(=|!JkmQ% zi8AmWeJEyl5Frs3R!o8por4%Zpkt^PxtRShbo6{Xz`yU%;b^`CD1!Lx(`=g_O+t9^L~lSrlnNHL8~X)1o346uUMznbL;x z9x<6UIX?xNC+rL%xhgH3wjgmJav2RyMC=%qoJ|sSBZQm{K3_?QQL%~$M;7wj`qQqd7VBMqyCJWTFROJ=Pj0 zhJ^HBQk5ZI)_fv-1?USzh>?wPLE;FqWK!kk3$1Ny;pV7Sy?=go7kKrmgZ>o&eE9tQ zy!Q0`47Nf?A8jEbdL8fzW?b4VR}H1d`bDfdR(guoDk?C{FKJ{L*eE*~_?Hyy%Srrl zzTAP-NEoD-Z=9D?<_p}vN?$2|dG)U}ocJFVB{iiL6<@wJE#0iFoZM}lJqTk{LSDL> zx6{(|&{I(svUGN2GymXhVa4X-=<-Js7!e<#m!zYWhdHH>ql1&XkdG+!pEZPD(tl*L zQ&av~#lv2dT2DotQrg+gijtR&hmC_;43(0SQpD|pwa|MRxxbsg{1T|9x367s&oc2|Fhn2mAl^{nAwAk6a;jJ0B|t zJsCU47xBD|Atu1XBl2hc|4+%kNBpa$w!4*^w6o(&Ll3ck%lGfb|5^CI4gVZc|KCIM z^7H=ZkpEHgcS{lWKd$^gB=MJ+|IB@nvlyxf`~TfDF;oL54^9{u2^d8gNi84Pqb{U$ zq%jWPqJnw+Ud&g8m*Kvt(G#C9OS(=WtiB<4Ox8IJ$IId-BL3aS=iVo zWHVWpG9A9_H7f9W)!~}KDkSeYe(Jki17AO0FYOixXTK^&mq>TUbw3g8I01`_+y~g4 zJc8*OT<96#s44&ZaDfY%#tqn}`tRJAO6%~n*&bBUpOF9Ska!J?Qbx*gP5_II^Gu=zHdeCP2rP~B|MZKUY&OmNKXayp6MUJR zTklW9|LOOSDP#QCd|!t7XUhK}>wl#DZ}s>`G5%4Ee^!kDTtfd@m;Wt|f3}kU*t7pp zjDHm4A0+oTM*atU{u}831M&aEHu*;}{!xto|Cp;I?hiYxa13;(Nhg78m0t(mi4b%H zV8?NK1^`{$XGEg#gXza<+piuAw$px-a+%S7Wl;sRa+*xJY8WNK7fxq;<|dWD*5{H% zRvUkOTg4w5*KfJfcv<{_c5B_w?K|i-n#b@<@i1KI-u1w|)Q<82=cLi<7+>U(JH{}y zncJz1Z+x91s3;X94fj7B4FV{z2^^o{6GPX+dXFl{{O|&zUggsT9cu_Ao{6lep^DiN z=WUpeat1K$isY!E7G>?mhkb=t%OWQnyiz#LiP85Lqhb@2w&s+dh{6^n4XGP#q#a5s zusk47(~2Opglb&a>xp zt3b1N-TtlclyDcg$!58QaRJ~kiMzee$RV5Zr`xU~G25ngoyo3}$TuZD{*ikZF=dU7 z@t@3bZti<%JF!@|vtr}0niOWkzmlsf=)9%bTteA6#s=vjvyO;Y7-DBB2i6xeX=N4) z`dY_HREFA~(<BusIAwM3KkNBI%ta$f{<}`9OH}`T6fK&#rN{$9 z7Df_qLwJC3TMeB2HfC2AKT&!$_54g5FUx8=sZW+h++521>zwt_Jel)$;#*42Spx7_UMX|Us;qw5M z<>O?tg4K+iNM@io1}x{%BAiysIGlU*9V2UM zhInPt?y!-RflNQ=;lZ$UyK+u^PGq?&wqS)?Ow#p0hHP{k+;7Xl6*Q4fj{z$_&S&+I zUVKkP%t(Z&_gI3)Gk7>yH42RdwdzxL`KzQNB}-8Qf*m&B1D=g^7N7sq((ixm?N$Wp)C+okTur31#8ebUVx zl9!2<#Z7&06|TovV1*C3x?L3}bFYit?qn{HM5ToE#{;@YnQN{7JW?Z41Gn;o2H8aE%J zIgcPL70)Y;@RRXZ(q6XDU&xlg&c>es^MMYtcYbn?wr2g2NDP!;%Ba4ax?!*r+@@A_ z7URKHj2@8usH`sP&o#8KtST82%H&&2)y8OcKU$?O#CK6^dfFM$A8w*FD!9t#66JQzP!-k_*?vuZbQkWJ)Z!JBw-L_7P z3O6B$|88`K``kwW)gnre8$vpz#X}7s_7gZa`}iAh={|Dl2XqOin`4en_2>j@GC)+$ zJ=jSZiYt0)!nqqfzQ!;->^k2S+gjLpFi_Z8#OqOO;>qC3o&H+}U071WCZg6L6M>Jy z&E!piCzs0udPm~@-Xa%?^wNNG*RA}`m|z;|G=Z(SZm}eMliRa~fsr59ju8ARubn2c z=ABGBuQ`mkszBE&;7k;<5$cO0fi1%HEYLPgJm7+Fv71l@jO-@nyozy@fNI){)x60MV!XdTzrVn8o3CB6ROB+A`fxz zSjj|3;y-Y*J3Eg?EZJrYPJ?n9h)*12%k%By6)+1A*V%$g^^mQPtja?M;Q}iQ8EMCa3W92 zo6oyB9c3snQah-{!VMi}>znkoC!fVYXMR~-O-*Q_6@)WKa+OG$5CJl0 z0?jj3k2-d91p&6iw5vS!z|*+Gx0V48%g=~+Lv;le@S0DEj^K_i=*kw7!|efm$N8OC z$6e%W!?xzOR>sdUy|NN7%1eEd!nVk~srqJM(5NpNIe{^EvxT3Qgx|NC9W{#LoRvUD zvC~&Bw^-d`e#ufTWMt6JLs9}yfxZcuymO22O{m1jOMC=Qpsg&^G`HG88(s^GkFWFt z2lv{RZv-5dZ=_uL@M3UXKu}~&_H(|7F%O;W=;OOoU`p9r3i4kufBNT)I^k`lv4L`(6AXcF(?2pSzmzw1jprJCuk1z%Cc^msqvn)X zVUCyMK;7h6j(qWv1C2N&J9ks)n?4EIkPw6N7)ieYgX+}b33=0TwMJ#aCeKOor_%Ql z2^Lz1r)x|P7)#Y;tIZcKPaSj(q%Z^t=I+Y2ju+;0R9mvQE9LDhC(-C^I zYgmFKeR=y#2|V~Q#YX_~hTgH2ix_IyAktMu`P@xCt+x$}STd=3ma)Z@v+N&;Wz*u| z38_0P8qmX|0KW3M(<$Wh5h(REDyOGhi)@HvZ|q{N-an4= z+YiuF5Sr%UpBPoZHKi@fyvSzMVk5JQ4M?ub|4Z*>6+TIYYeKwwR_)nEePL!!5~UjB zTg{`|#>~MooU@DX9mgE!uoQ3XtLjTxNF1k9g^@5;X}p2Q?cnuF z!&6Sf)#O8s^V=#(<69JWdeyZx|Eg%#)8l6%IcfdcmL*%k9cR1D7Pj=OEvFCEm&pwZ z+#x+qpfI7Hhf(v6*E5$+ZQi9-ZN-BG>@`uPqACk{_n`fUe(F!W>knW_Re05;Uh&p@ zJKAXHs?bj;%QUfQzX<`pM33A-oGXKJI3zg(0U}7^F=A(VR7J{3fB>#Dsdfh=()*qP zcBZ7Wy~U!hP3MeLv_8m67IaoVvFgBNV}(QC@a(svVW%2D`9-C^DnG^N$UxaA#D)gF z`?%$#<7qp;jkcCC(K1HUPjE1msB?iH+Sung)m8s`ny4u`Vl?tYx;a4&4GRT94mF}r zKb=TIv2qS=;W`Q6zE;;we>@m*+-WBOU54<1T&(h{mS#W32@$Ljy+QyLwD=#bLRO(r zdmv(Ykc-WGVOYY5} zUGiHMeUBsAp;mGfu{RoNzXjDgr0RLVde#Q1Q9zG6^!di*9^lxJCC7+z{WvKwKtu{B zQE$Wa=L@Ri+=~s@oKDm`7r%WU82wf4Pu3{}tw3V8Nb>%!5K`+b{=g>ZPS5H7iJJC) zT=$rE3XW!8z}VNs~#wm^G6G^O+c;@1H@DlLD#c->P6TJyR6mVoY_OKI#Hs8lsd zY{>HRAat*ZJvHbqrS4!*<%-F!!_iRod4xPt5-NEHT~(K>Ym4+UVD4@3snpyEh=Bp3 zfD)`|yQNLv&9bx9(|9aotHA(OJQYa^+B%$+!}9-Vll>UyYf{H9XdbMf1GUiAb<&W5D6h7cET0&C(M; zew2~MYRtdhoQXQxcZM_>JA2-z-&eXYM}$OwU*OMuddH{Ay4=vu|}GGR{= zmudEYRq%xuDB?CY1Skk#{&MbL&Z|Xd5`?;tZpEx&Fy9atBr{f9ZgPutz#bFgZE}(Z zDGK7DlP6BpLU&~jeHFuL$t+4yskN$WyOA~CyY{(BCq6+EqJQJ)g%I%%SwNSz`t{8} ztK$@Wy{ehSqL2KwJ<*vjPd}k-R4AC|a`7%|G?kc!B_HYdr+Xq*v`E^P2}0msB#==u zyZ}NH!AbX7X-h!*Z{%>`jV);flh*AWC~JA_y1JI7#luWgoot?YuCqoHw78pTZeXUb zQc)APdH0n*-tA?ZL_yai^={az5%Z>Xgc+RMn@oo+uUVRsEFaI@1zmFM_T`%3!h>(| z{q0IUDB;{+R?IQj;u%dEbu5nP6Sadg$!8vPNj#K9Mz+)KlVX%&)Cd{ZK?7MySLWgh zN`q{+X!?)n`E4OljJcs$=82MmzDA_}H!pZ7I&U^&$qGY~!#lr&RC(ls?{OL`soEyw ze7l@7_k9WW8}d=yH#P&`2_@LWWu^wWg>EPviR?lPKQn* z%=4P7Xr~zmZdv%>?gNN84~OL11ALJiwz0ze>*|ir#%;p| z(R}<^wU68JsZyvRr;OxwsO!@@U#i#kvVGq#&~iV=-r8)I7Bew99}~_D|Gmq)z$a3W z)#(PiEOuWfcthrPh0NJz^sU}N=CLGb1m$KbY^L`(3u3dPHay%D>JlVSPmWl9;E=jsUAu0$&XcmF=)Z&~^g zFJQ5OBEUQ^4#|^H%z%84*=MmOhq>q(0tPWjqz-zWiO#N~XV*QJ{R->VsKY*QH)h*X>cQ zNAA+}B zzxU@<^ai>5`hTfWmb&7Wp??;h_6Qwzl}r805N|a@_8@yxZ`0ENCci)Efb#Jb53-7T zdM>it-R9DF;Ln^K``ePqWwVWAmsH5S6XbFy($f>Q0ZkZ5Y>vh@|t_c_pcv3WPCRWDX$>DGWB>OYUl$;YaPxp?%f$V)zwVUbt=X*DrB}F%}Bk{UOgvqSGYR_g^--C-o1j zD;lDLtm>NB&`9>Q=Q5W!o3y<=CR#ncRU>&NusGIq*fHhz6NJsNxzKrYH0fcrwbBom-aD_Frs=JzH*>)=Q3=+rUs*_P-Z{M>FyqpLIact3DK_)@7NY3;Xf zsMnylxrE1)mw(2goN&X&mV)ocb|D?6{=oL6*B4EC1~i@44TTR!yio4vb)lp3S@N>j z@*=`#*!!tc7Gg?dVY8*0*|mUM0b+cRI9l3v8d2auONo3WWJoy6)D6;e6WsT!1OZ1m z3wYAGUiC0U0Z}@S$2<{X73uA8KL126C+TtlP?_o?Vwb_R^HD~cSf|+9$V8!{3Ez0(L-SF9)LopuMi_+1;XAz`;b88ZA^d~AuuA3#)+^|w zjj#g>{4{OZI>wdieO~2IvzuXi^)h0T8pt($OAtRM*Mak*C2mlCdQO7Wv8`qP_-UBl z-V{M2Q>(PB8=V9_b9v))8XsRjcCGrgvPzm4aK3JoDE8!(U5ggOVuc4rUa>%tt6=r1 z;-ZHiDK_J;NAo9^fS1qD?#p}7(XcaQ@adgpcVcEA4^p>-O3CAS4cP2jq?O>%hdACo zn@tvo-LTyL&ak;2JMWMW6ygmSY9aNtyyoQ;vohvDoQj$%!>=s>?#I~i`!K<2Zt0pG91}#(PC13!omWPTqGWv4MMNji zY#dWNj?m@G1Y$jAqH-Z?YAyP|Qs0$;$Fm}j2IcRLe!panfDRn@{g9hY?OV!f(m^cX zH{r5{cAXosGrQ`F&Pevc!5w902+fwVZL3dbav%@GD&EFS*V|0TV2ec^6YYfkV5{b* zp^t}<{QB~4t|RKn1&Y!<5Vh%U?)Hf+)hlPD?%Sjl3t1QPRv?%%^2>P6zVE2q-#Gb^ zMnZD~{QTSLehqwF|6)9K(r#m{1Ynl(>NYOQi#H7)Km9cLQBxyQnu1?_yVUU)m`+Gk z_5*9!lG$*65jT?$c+Vd!V#;Ee4&6Q@Dx@Dg@iVK6qpUU*$|*rPqhldCI?ilb>k7PJ z_bz5#^hOOl#*ow`E?Wx3`^TeYue>|gdgevSPlgMv_i7gTqgC0X)*{0RAI-QQqOhkLzB2JV_ zT|cME?yD$cF@z*5%2&~4h|v|O9naiV1;1~dp-V-^TYHO?5~&G(kF42ol6=@mYrA6x z#_l<*ml8DR-|A$4uv8U)ACRv#xmo_y^{`mm#75Sv_6&yT#5^*KxdfBR%rtgEZ)~~7 zIA}&u|1?c^v5P|AvI$G6{Ge6wXyGX!O7sHK#h1V~DqN?j(z$*% znY2Y`jVTuqbkJb9G70d<$HtJF{Dz<`x@3uY(&)W*YcK$J3B}G5cIMA>Bcw08tH}y(GKX{v7R? zs-E_~pi5m{1JLxT&Oy!7y%^~31AAGO3h1dtzKWtm!$%?xK@hTM zp9sjG+RW|GGcib-q~02@#-@~xm9u6pMnVjemQ5c|7C0jkGGl#ef`gwIuf51gYwev4 zKmOovtc@+-W@i4yaaBFV+*g8TpLORCc>kl^;|Qk=Zrkb<;c?J2Ibpc%Gotme@r?3we}>?9qHCsTfE z=98ydzF4*=o>_;pllQ3 zgHQ(W)r_(XuKghUIq<=zrk|&ocQGG&839vXoseioeuJ<*bn2FJC1ecT51@G1@Z`wU z`WXDwVd(gL9OUs#RS2meZEC+mwRfzkJ9IYmlIjU+w_@r>?j(G%;IFB_o*Kbbi1a_Q z1gaM5^3ZYm7AlqRZV05Yp`4%QwsZNfmuD^w9g+lm-Gva|L#Eitp!xc52(1*<5#!uH zBMm_?pXNHCA;P&3vFNW}$dx0xT!dnHtgK3^FHDO$pvAc)Y^K{}|327rrTw+k0Q{EE zTR67a9B`w<^|Uu4$9G=q>%i}Gd@JfnDc|2K*8pav();!UFx*Y@&kDp4r18=g`|^Fo zujhjN4sieEOpBL&@8T$(!4`J=~W1Ey078bwTb7-Fe4_{CRkqZr0yc;t;5RgoM z0MVq*iENY3zSV{Dn`Qs)XS$dC(&9h+^!vhjQAv%WAF|{RTZ5=#{oEDo7q;pK9^uAO zDu}Vs{h1b28kyxoSI*uo(!+g|Jt#(+tT4zF_d|=+E0sHT2qfM)l3@HW)Z;_iAc*>= z>tU2?Yb}OHWo^Ew!k3}%+ZP1NWM2=%Pb=wzR??qBVb}o=)+Z&Lr^t~=(UiUd-oye> zq?>`H>vk<3$+mTo%2%lN4g$fq;}plWpy0;U!RaFJNJxsf*oQ!4+_kE3*PLv^uei*8 zRL@mvSIf;d_Z-`%_Ib{B{RTA3VE_en1gGZGBL?-?gQysMmoMx`m-B0oA;+=H0~Wy` zwP^YD)EOj$J$BI59HNF?p3&KJ3n`iJ?p)wo(~I)dKqD&;uzP}4VFY61kAtjb-q1ZUGVMZiDScOXAl42KCUHJ zEen1@rsFBM1cX4&L&;+%jM8B(Z}7 z_S}RyLX)1xAWx$bnJ;@V8*={bbH;8l-^c|u^(W8=u1Y*|uxpl|+En_A%j4_3GB>rt z`KY(mJso4@clRtty&e>AT22Daq9I|nn~^_)aOLw|#FeLkT>CNIW+xz;=IbhK3iI#I z)wPHZXBc?Jx3&{z;tS|1Z6Qd^L~BOUHX5yvD5__5bsZi~^1-F4SGew zPFE^eD%r6>=E=_6(_ZwE?4eK)Wp_YW-z6LQp-MoJ%EOd?56wy9y~50+IM_iYuI|f~ z4YA`F|K&9wKlqFf#~!YJChtw3N9qSSH~qY$zzh#E5v_JPmwy|70?zO^{l^gun2Yx8 zB9Fx)w|9mh9gA)SG6^*ATJ0KZKx;EI_m9j>pM2!dH zdOiG!L4(9K<8u{b~l9 zOO@&LEK{OwxeS(nlH`t;RtBUCMOH29OjJ_lX6K4auPJC2XLpX9q&|NLXa9?;eSvI~ z9Fuk9=KeQoYmFsHQJtoiJz9pk$9YpvdlN=>ag;o<_X#sK#(OleGZ8^Gizh|}V+)as z{-5pI8grGzwmmM_DfwDNKT3zC?eW{hmn{u@vX0j3TJRjaU;S~Qyu`HHkF`!qC5SEH z2xpELIm`$z$|BS7QR+jKsL9 z6)&6=@aAp5aicHfCCP(4B~@LI*$1|Z=5mS&Ayj{cu3Tfb@^;15SbaYmlz71mgn$~4 zkogqMJEM~=Ob8JtN*I|~Vu}wP@QIQF%zg$-4vaodI+}c2MWzj1x5)%CN7J{9f{-9} z?Bt>Q>c{0W6k-osFs_7vZvckp{g3ux`=?^@wBW z(Oy|;Jpf?%W0A?*U;?QM)Wdu}@Zz3@-A;z5(?G}$Uz4r@l3XsIWnr0a_l%9O>6`i( zjjy2!7xNsiYABSyuN$6{zV?{xbadOKo3lbECQFPZLtfd>lI z^yKlw$+!SLRPl_Wj~PMsrpCu4Ahw8@b73(J=cGrCo-4pxU$b$XEd|^pG{^YaG&yeg zs1U)VF07!xon-m$aE(|kNF=pE7wl`y%s&t`&zxHAb5;}feX`P7I!lEa#@b0pHpo|I zUbtlG#ZfPGtMJ#5!{BCsd`_-GR%xc~gd#%vzLnx1wD7~yME8^i%Lm#1n3)R~5~YQG znVkOmtydymut1M+%wWG9<3Rto2@v@~VWaqCf_D{?|62`_8$b^sU))qC*L}uw<8WqW zNQG-SYoG6ZJ#)v#6W`$q_s1I185?IYaFm_LN)44A4LmxXvddZPz=8m)2@0&cZkn;L ze+jFU*j(+nJOG_kg*fVsR<%;`M)Z$k+fP3$nw%W6?+N&t1Gko_4ntw1?XqbKi-!6r zSO(aer&*%BWE&i&&Avw)#_Y^PN>y>L3zY1;wJzpQntCMRY_6-{O znP+d>KbHW5ZhP38iI2FOo_-T|;9Km+uwzIyN-{=BX;|Z_6d6G^FH|Nh3p6Cpnw*Al2V+3D3JvXE)vC8R-`A3@3V-YZ(mSG)EV^~6drBj~qw^IFmNopS`3{I| zVK8}mG){wlW+!dP>IT{H2evK+?GXx5<}wEWK=^qd$cScotl{GV=(d-dsSnGoWeD-&ea&Pm*qt4c;O9l8JL! z1)tX>E{i{y{^~6saPp~LYd0@`m~&1NxR9x!y0@6xHltj8KQAduWpcyW|C40@UrKEc z=iC!S8i@+sQccJU-kf)IY9cu?`1q?%@K8z!3Upr;F>x<>yLTI~Gp1Y9z~pfj>({Y= zjNeQmN9hIGgH~EQE*IQFgFr5G)F@>QAwL=~a0JfmoYrj5@j?XQAC~g?e=~lPYW5kNsJ_Y z+Uz-Q2KWPy3MdYH88zZ~o3(Gc6&lN=LoPx(avvvfw*yYg#KJ0Y(zdv}Z;#xA{Ymq- zpcX;5@fnilq8BY)(1WciE?#Dobt^39I1fyL?jMNj^brt{m5b1pf* za>x4y0JNXx5zA2UmTl~Tkc-0HtLZ@OTsz32diQs_H?3XYpsg%QzQrJqBY{4AXksxk69+?I_H=Hbc2 zd8{#?pMvh!vViiZv;t-o_#Rgv<~x*2WIVQI{o^04)_ZR06eO3&1a z@mqZ+qS{>kYFvZS*Emt<xxL>n}9`ueMsbR>&<)^YI9Qp|mvd!NK_J`uF88oX&eZAptVD0QB9e zLO-U&=nt}KQ8x0qMiN%!YbilkhZ*F-HylvT@3kc2jX&ihgU-NC_2Byj;UkW4EuxG~ z!;<%Jk4YOCo_|LNZc(N2*US9i{MaA#<-2?QaN`i)E9QVL%zpV6a_2gRy*&g!Fq>!8 z6W(*M%w^vnt#i+HbP+!Fwz{hL(^f)GN3!Mz3`zK_URuG3$)8x^MEwGHvhqrw43Dc? z+RJJ$?$ClkNp^v0-(CT5<-SP)bKUN@YuL}n9GEh_M0g$8#kjVuhbs0{O<|A}(k@X? zc&E2#sImAPXMdFZ>F&S^ahF)Xsl)b13yncUtv^0S(y>gt`n_FHh%t4xk7ZWa_AxMR z^|qIoQ2FTB5|C^KWaHd3pPSpJvDCwi*BA*)MXM{bukAF{&HW@8GYWas4$Pm( zB8+U+Zt`hz8J~=#Gt9DFkIG$LR-W~Q+oj$FWoG{38sUJ$Cqwd`H_>!dn%DIYGG08~ zzm-RP5J*>gAi@q$-nx@A<1rqsUB8K$*^-?636ugTy8Wjz* zLBIXK-sdzkM{x+=`34CrM>4bu54imVuK%{|)ahU9tlm*uYFyCPWF`$FIWclFz3ed22Q#7gc`rVmJ5V+7B^KmyzU| zeJJAjO*|q?bg|7Nay+%(aOg8Gj!OQ#6=SnSF-sibCPfBdkkyRdg$%ehugUsad}IB6 zQlhPxQ^1W%iTNbY;(J&F*wgj*(LH-)zcPz8=Gh1O6m=eo>)F_w1?4AN0}CHm44$_T z+o(jU6jN*N?_AL_XP_3H$?W#Yt$OMr3oU=GrJ*>BcShw&Y=gqi+MaEz*HfNsnFIll z>CpLy&Ea@bP}clXAZAtA-0Hg;0bh5mlR29tBM}S@6?UJO_$|T*HIEG)j%aGJP==(9 zo6Q7fv2+_*%>Xeq>9ke{vIyXlH{uIkYn_;JP?7F;22`U3}nW!FyQbRy)L=LE=rF<&aT4cr9MzQTe%$c0W!QSJd+DeAndAk!z~h zd<6CeQP#|jjzcw+>C>t_J*0|IF2F!87jyHiv8K5$STl+2m!PZDJo&Q)dl{o@I4te& zn4b02T%XUyx~FKIsKqfwRQjp(G1csUt!5DnE|-&7Z(FYxB`BJIngL;TUt%sXA7|<9 z9loDmTtNF&p#kj|Mn=+>8KReIdDC_$+bYLAh_08D>$eVVBkkcRw(r*H9<~aS%Fd|r zuPwwP?`b)qXhw_a=nN3#GNccidw2?)<;O*Nj1^?1l9`)7COER((dg*$9I`Q^OAWnBq4}q_4%etC##rc?xIN91{YJf|>!$IKiS95Jp z5ozKHhtADg0u`#T_)n6)c##E4ex&_NMYSBNKwDGo4U$c+&BWbeB4rtj2LpnvrI8;$ z>Qagp#=D<{fvfEl+|fp#3C=(0YsC90US4=@0FtE1eIqFsP5#~-BN$H48=`6%)&;nr z!cDwQE|6(AeyqmR($6BmataU{4YKi?Y3+oW>Agv!Kh=1G_xGSx`8fW)z?%ATzWfP1 zo=%SoQI@00Zdhb`Wm6>Y^Wc|&2pnY_G`;=LpWxHj!nx@sa0_^b*4Zvm1e9Mtu#f^% z(s%%TD<=Q?F93^To#MCVxs0MhnDL9v3>^@Iqlrcj$In%3S|4wS{mp5WjVt z`Gfi3kb&M1OM@$N*_SC)-v~GT(p&jlDc)pv4FT1SE0f}i$={Q51%yr9SE{d1wP(~r z`64QajFHSGYx4L#=?6?vWN_j4>M^wEL&hBT*Y5hT$|zLnHkoFs({)m3Eo}fyHS1E+ zA|57bTZ+-$e}xSbMD||tRMx##TP9Zqk^sD28s=9FEcsXJ0?bhb_1QK=Uu4_me7&^R z632RlFROQo>-AAT>caORBcTop$lrSd*aELO%D)cBW;+Kz>Lg)cDC;>I%UX}DNu`&G zu<^qg06f|rH_>KI#0u`k3t5JwAAm?60+?t>`>yD58;Y}7$HP+0-E@BE_VOGEj`O($ z+KcB`p2H+`6Bul3h93Fq^xtJ%il2-gRlvIc4PQ9`4^I7V(5zI+V7Gf%^URf627AKDJ^pFbynAtCe%INQ48ZC(aJ`2#c zR_m@CwTNhS5gcjZt=jhjAF6dJa+@%ZR<$P)7Nu@yLhc%2Uqz#FVKl9bKfy z5_xVpA2^!3DGoCc@9FE)rZ#1QVWB>DRC!%BC%u}jBwh&LHc04My|58AU8E+)A%{EqZXPS>X|DIR&(8u^5 zSQp~dn7BJ^_AWn^`GH+}7dhem5TVbhtT5UY6je~S#!!e^Z>1=L zcu(`MxIzcy_}*L=e$^es?;b}q1gsT<^xt=Fz@>gf5{tEMa~R|<4bV0=kn<=;+%6vB zaEJQ!CLgIb$Iw7f)oCc(KoGllwex0y=2gOmmHFE(qkycU%BICiuLY=+-Z05&K^nS= ze-Z9em5-giD_g8~K^Dp%Cc$=;7~$As1M>cMN(XAgS2LS^bz6;0UA7gK3PexJ~&AWRLkYw&OqeD-E8l5i%(w1eyVPVb-t0`pqU zOe&3s`BJljrs@Sem{*bL9neYE=;3o{HW799IRhD z@cjK|37WLo$B)Y<{%te#44Y_mIQI5GBBJdKv*FfgvRG>DTTGwCo$A@2&kh$!gGdjP zvnel?I`5G}(h5{`9%kK*g&_t!Zu!pGCW8HqDEZxGnY(`Fc{lnWLB5FM=WVtY8eTHpekpm%?CRE{C0R|nc%g73DWlkUjg`?`#P~ti zcjPLGYVLQhMBdwN#h~(HSYVXazf_H4qeYP~s4yiSN7pk(&B#`(M42h+{O~pAEYwAY z#9~}gI46}%-jVu9?}W3mE!O#&Xgt`#CQu1W%XpE9aCjB0q&kqbK!+De%NV0rVry~v zRhd5Cb;iZn@<>1ff90i`T!fv7z0Go~)amQ-G~W6K|Y z{xmWAwTrZ;kVnnF!*FJ8oeWUT^9qfZnYSrUWK+v8k|XdV^ihvRB!aCuIU8aH&bYFq zR;@@1I=Uw|{9f69_Yi+vxjbp%xH!tkmzrto-Lqu5wI39v*l z&xy7RYkBrfKnGgr_QqP_sVgZ!%IRtL)95W#OCbAd^m~Qv0bm-!?qPLrF{YlG` z+sRd6Lh)C8AeyY1MZi#dQo`a-vuv{70Ht^3Ri#zS%UQFmTAU1HQBtME_L1MI+{R~J z?~LcQza%*xenDB4y_FV^lN9UDCVi9NyakMOM>S9o`R zB!%i6CU3Uw(8^#PF)e~i5%{-TjxL0gC}3|OvZ++Zhp}AnOg7H`jH`0pJ99AqVtYyK zA)m0h7eO7XNs5P;FKQq1RFB=Gu-iv9svM((M%b!u<*ko3i9BO<#$8wCoJg%v2~YUW%{ZhxYUXs0@l!vBm}Z*t zn=uH!*9k*r@1{{IB`w-=_|6%{(_NC<(slQW{x`(*u?&9RW%>u#OJKw0-r%i|7Zw$g zSK`ty@L^LuPklLZ-%pn2uq(EWZ~ED4gd@_G`i(TGvZ@nkC})akTV`)cN>E*Lnujd$ zvJz>1(VY$Go#<7Vzh!6rO?@um5DngeO0blVo{J3|8_8+N34wdcmG1cl6cg;tC%>DS z?M-!(62gF;2S>MwWN-SPlySQ$<_G7==dSzzz>ek*uL-SKeQ-B>Y;8X!?H)(Xe^}tL z+KM<8cx1)K^YOv-rR9Q&H5)$gv*B71-iYHv`_w7n0B2}zg)b=--_MMV_@R?c3tzH3 z0-NHsS`%w^^SxNpwkY_NY(>xk{QRyw31-TVTs~CC>3fsE*iuTS_BUXRJiExWCA-+X zeQ8D!VzpxGm8_A^FFRt7N^iO{f!eWjDM<$l*8_pF*S$g}f!utp#u_0m%?KN82gSCb zNpXD5WIzE|)VkGg?##LBunb4ihKfc>KvU-03)KBTTJLQQCQKlx3+^?opB2zbdEuMMC%!l{w+s*4)>6xC_*I5!MWT`^tT4oQE& zi6s)ScAqqA>h_d^{6g^4%p@_J@mhA&ogEA{Hj-iiC)-6;Wynrwz2&*dWmSo z!;i_~o3w#nfWCNyc>Eqe_+~9%yJdi9F(DfT%6;JiC%t%F_}OUP0ghN&qQD_eH}05L zswy-(a(WuJfGurf;3G{k@$y#9)2@l|>2d7>RhK8tWYR5Jl0HtNX<$9jq|X!w;7>BN z6NH)neW8xndV(r@&8L2$;8xC?x>8-;y0A>0R}V^(JJi^t$WJ!zv4j6=F%BieYV{QC z0!}Ae9p`U{ zCxpm`ezaB~2I0|bK1>1=~ z{xEcy@#SJw)%@*=^&KIKFc(;t;t~L>kNoo1T0YkcYSWY}jdn)~&$D_6@6D#koxX|Y zit`k3m(OLyc}M{Rj1O9OI{bq@-b7v~QL@oHJcFe9B2}Z=kR$bvth7G<;6p-_074V) zekz-XGe$sjDu#UR<=53+6rgi%LwhzemLc(=2^B zx?4q7Mcz5E@SQ&vB{|n#G~vEymCO3swXPogz=oiC5`je)(_4X~pp#kn(PI!dMB&p2 z+;gWX^5-z|Z%EGYRu9<&kAO?A$U*F)MoY;XbS^`0?Gnc}VTV)i_0LoeUlt0}`?9Gn z5=-ZrJskC9{MT3eK8%nb_6JCt4`->(Z4I?Feg&S^ePE9yD%c*8z})pcXSZWiDlH6d zM>cG#8-EGqENu?3tona6U1eBXTi2}6;!be_6n7|EAW+<)KwI34yGxMbE~OMF6ff>h zaCZpq?hxF9e7X02@Bhg2oU_;7GqYyRwtciK2R^i684+OEZ|Melj4HmAndtVTK1RvM z0{FUjO9&j7xjF{-q2G0pIo`m?D@T`&1iSNf$SOjLdfDJytcCu4kuw)9BVhDusi@Bm z>kW*0sS?y2^#5)E{?4+7q}Lft>An~Ieo%n#tL4ixx8K3rZogRN2oPbvT=DPZj1kR+etKyif3_}~@$~LdSg?z0GJ%~F6S~rAB5b!E z2g`h_#T41LBRKS2@ohx5AHrkdPj^ZT16#wigC3LQx!!ZzhPp>D5J!mwO@_y2`#Ywv z3`%@bqF{I40=`k=M(ZFD*G!rV+6$bLZFdql=n^BI{ggrwsWD^t-7>uN@lyumS~An; z5M9RRMF>;8q`q0abH6Bw<$D&pZ;OpY6vzik&;pH>8N=o}BQL5c-4Zd_gdD>}gJ-hk&k9XMrLXHZp zK*6;;oQ4a3Zt3^U`W~~PWL9?7=_%lGY?>cl(P%fZL23ht}q^n&* zoi`_b1lr?d=4NmJ;EB{x(iDNU?E&aMy6X>1fUg1kjYQ<|RXP3u)l(><$N~OG?_9l@ z-oZaGw5NTbZ0d5qhIY_)sG@u~LQJzD`3Iyi*`3d>&fBHg+nxQ*fXf{9z})Zl zLU2&iW860%BgNB!G;S6!PP+rKtn3XItg(^jbJxiy*z&iPLL87f;m~Um=!XC(PxO)F!bSS8+Nj~JujK=GR zy@fB*bt#k}2hlb+8F^#6WUhai*`!XNE<%;^ndt6P$1 zvhp7#d+!Joy!n>`(M`Js^X`LwAo>F2D!H<}g`9!u+ zF(3xJ#||U-b(VWhl3(Unk_)1vlB1}_|IxoSE;=6HpPLo|uR_+?Z@#x2-~Pc9JN>Z{ z5PCuac-sFNK|zEa)v<@c0kACUB8SELxk1YHHc*DK0YGCJEDZR2b(Nr4ra7#(!&bVP zrrZVloo0Q?iY^cnt#Onj`K={mq|xt+CYdbN#m{EX>tkirq>2+Pfdf#>Etw%VowijI zKloi>t1sHS>!TJnn@{gkJ#K$JyZqJz*+;4zZcepgYW8(M#$O-(!9{gp-{V%x3K680 zOeW~_&e5=vxsF|YI_^py)vz6jWI0}FCOdAFF$%^G7}286%&8czziNJ*sVqXfOPYHW zokf^3cV$VX`y9H=F+Unhy7SQ}f&E4P5vtaF-a8bcGPIti2BDsmT#U?C19tBPTrj2b zKC=REH_0L&Mz03y+q7AeTWEx5gU!y(DKlNUZ}o2B{o(B?c#N&tqdY`;&8(=O!JppK z+G4NHt6=}=L-ne}A7wtTn8Do*ntEq!(7wSnLp95G@tqVz z%)JFygvv3rRwpWcT<7@tIo{K==9?_*d(;q_jY_1~nSOO!lu+95tq&#)Aq*YG@rKDp#1`axG|5G zKH#7E71tp-tlk#8<{lme&lpcS{z_K%P4-;*i@zHgZ_`BQwymSRQ%R-Oyd~dQikw4> zxv-l%H;;TFt95NtfnsD^!QKLczcU;NV?Q2TEY&yJEJByQ#60{>dr#_hqi@d-IcvPMb)Eyw6?ko-L(mGJ;=9Z8hk5X&yZzd+}tN^ zb|jQ3Y9@MN|Lv9$`rF-Ddxbl2#?_*;3#dOT`>R;+eTUzJQuctOL7(KeOC{;Q50d|K z;ZqSD#x66Lr1&f0)}x~K%bFub{DS=q4I;a<-P(S9Gzm(#fV95DAOZBf4iZ`|jfmCY zwpawaWkO&YZaVjr0`y6SPp6wxG~@(+;z*xm*F#9?B)c{I8++@$Ju2CPJ+eSo118sl z>UvScc;9nt5fQE~$ zbiUGT(qAV6wH19Fo1GuQuF-)oq6az10i3nThJ?XN;#SgKcyP8+9W}>xtYQ8LF zh_>{LJUA;DHnl9Bz{A}ZA9rwu2c0H3hFJ33zg&_?Kn(n<#t8*-P~|FgP=3)#B@p=Z8xWP~dEH+;u6=X1F(>y&qup_BBu;#| z^JhT=m8kDwz3*W_NfI+6Tf@N%sm^X0;Va(t^A*olP-5(P>vT^s%VPQlUrEbZ4|=EF z$FsVJwQ330;8*ccn}+)si8{_2RHs7p~U0SxJtQNrt$ z2GqMikNY41c*e7tIV=QU3ZLO8o7Puz9Xo>{Ci`u6+NX{BRmUOWJYrH~Fae2fi{~># zlFmhT1@5vA#|^>=8{7O6S=y+Q;EfSbZ!yi58**HCSziM9AfYW=;G@lD>A+Gy(=kz-H&pXc|RtR4}HFL7;vWI$xt)JU? zjG^!TOEU(h0Iy!SQJ%icNUY3|pgLykWeSQnaA2I6dH$45Ph~aF=(ovs~y_=57g|B9W zDMbE3YIA`_yTr#b@awmXyNV$sGhK3^umyZ&|KeN=`Fh#jwo75`J%1!oQeR0`m2h;Q zVFYQau0dtlKq9OCkH5kfP2VHaete?431I2?av!nv#=1j8=DmX;!Wp0(nz)gV^pGWl z_Hv1~5GMlAy}1{G{3fg20Vcty@6cW=Nmg!I_gf=K$s!X}0>wI}ta7?-#`z?yY(D4h zQ>^Ew5=s_CEFp8bM}*xVcV-cj7EvgR(mg?4Zkv^#mHI^}+(50~Bs5^(DI)HEr=sJ} ztiT;YOQVf}UT6ZY-VS}2xtfW5&7RC$G+0uI31aCnt0Lcd+1CPW-f|`fsR^HLvoB&m zHJT3$_5c*F|TuQ@Qr}@hikMsn!{mP z!iS#UgYPB%w|^tjKmNn`Nll+4_L!+O4-S}1+Camw%gf!PAk}2ja<&Co-h6>a*kiNT zaiRTjb&{V$zjS3ij-E$H*lSH*;sa5~zRElieUy9ZlP*bqYyQ>dNx(z5v`%Xs z7j)NSjmf9NUc}3xz4ftH@49mn`9aEj&%|~`P#6w*U580_&@1vY*g>)kEnq)nF>xM9 zsb_LnjsfBXtG!Xiv&3i_01DQnw4wiF2N6(5^nuOgPn=X_R9_h30p{-30J?GSg|GXZ zo=4H%#BN)TkQ(K~BMwuki97cu@ePDfaJRX{d6u*eInQ0-feIzIjL|v& z5ZC<1^Ksn*juJ6hK9-Up91SJSO%!+-yW8s5-g>{gxciQd`r@-)-Jg>j zni(G#o4|O0Pa0#}m)0B>I(GyBKwAo1u!Ohk zR=vFFO&kt~hZiQJ0dd>A_ZFMAMyq)gn&wle+#6tXWB4yeK7&=`G&`Hh51Rc#zTbyi z@9rRcfevQ7rd~0My~16nvA|a%X4wo~CQDJ2UFDE!-Y7ybR*Dr~qzQ=*JY%?*9>P~n z zO!3)vU#)%VCJdH}H=p<=`Vhe1dP?as)-)1b=i~!P!=aRU`ZZuYjyn80Gw4&($tWLu zT!roGq4622unKcK>$XYmM*I zV>$aN5KEBbDR8K}^}xfDYP^^3F`={ipA2t~xJJO*MO(<~gA*zgdb+j(5>|wZqf`0M8t^WvwQE&CbDFow`=6d}&DU^(hQiEdh!jaq>whCNQ=lIT-)$ z{o2jqro#1vtahMM%Ub7~?P0lXJEz~RfklP;VCxeyas^6Kq<)uVPp%slbCtYyXn93` zIN6LH$g3UD&N!Lxt$@BnY&2=~AF=!z5B;cJ3S#M^?^& zFB&(0BFpmdn6zG|&7s}*^q8IHqJ12I#lm%LoJ_XcTYFe$Sra`Q>UlfGppGN+8pogy zJ9g3FsUCu(lcR5MZ~mE1P6?M}H=Kw!GP1WnHtnGGJVOMu24j;37JKLJw>R%i&FRuh z1*j%7Q|_fYs7e`qm0u)C&kL=Syq7aV`h0r9ee>y#J4|^Z$gff~cK!aps|5sDUh#6W zj#m=+M5(BwYa#5tTd&qjK8(_Wt@&CA0`~QZ6*cRcaIJsrwpAu|#!XhQE}Mf^k6G{( zk8~`&_Z7(vFuW*#%jqs^8u2efI_(Rc}atT+R#p$xEakYv1 z(}TZAQSg=}1S6o(Rt`s^uafvTbUEN6-3U-SH7np4sI_9V>RCEgfORSmMIY>Oww`H< zh;SRq{owV~+-EZu^Rn4kA+mH%)12)%y>A%P$z1p7$j`c8A5?}+u^@1*Z>%?8w)J|~ z?-2w#4(@9*v}?hoAGa>es$G(aqo+=666&*^t$WE&qillvCI@SZRzRhAZxdLi_UdiW z235?U-pnfGW`i@H1&m&28WhDHiatAD{?)-m|7A12xfl=->--%c|PaatCzsoTMbY3k%|CZ(u9@;C|x_s}2htH>cI1EPE+((Uc zVpRWBy9Pg%#zB`<3&dsD!QvRZGEq6GO%G2TuMR5kQ>;QM!l(` z=9so<6wXnfOM}8lWm?nt(vv%=v^nx(TEeeS6@vK4{SJ&sTkmUTWMq4=2gE=ZiDPrY zjP^z5_#=l;&<*HogHfZQ?3C;&mbj4>v!c%5PI0ZwMT|tnv0Lb89vV)l((I4N)FP`2 zf#2&X{OV$1K|BClTwzEbx+zq2YoF`E<3yD@^s}3)$KQ%1rI+|lBi@9;)wF`%A%4^> z=|MYVM9QMX&Y$2`X`NxD{7ain`Ef)+m{_-oCFIbny?k6kJ>0lB zYP}tz_7wh1l_m0h#**rA&phfBSHTXB?zJ-v3;_&!=O`V+klOehX76m3d}IeD^_!o# z28{AzuG1s7b-TyDQQe&1s<1-m>Er@9+mSwsVuJ}Vg7?u+(Jvn3ke+WWZEQHjc?{CHJCt;q2VQM=hkb=eJ!P`3pcmnJV$sZ*3j#{`J7) z&RKvNg2SS6eBfQSFNDpy9FG;uD-zKxq)PaVCXTei{*;fX!Q<7RL>o7Znx78#`Q}Qm zGn}q1gf8edZE|jQ-F2U%fF8TT^~4QKHq6Cd3VJxWBAQL$cK_wswc}i4#ca^-h^AvkMCK@c4qwLy94` zm$;36I?y2IQK7-w#%1r=!Q(e0$PWh!9QEX0DdM3sm38ip>RLzc+Bh7#L5@0y`tAU7 z=(ga32~5r~`V`5l=Sx2V=}G_|=LZ*@?~&%IlIl^#_l)6iWXGR*sI}#kvxnIY;NFWV z8Q~LwiCoW_F6;w4^ENY&za47)9IX~J(u)Vj8bHWr4(L)-Y?>5B9>vy3;_$M~Skpwf zmn|elODNFbmxWrgi`uA!XUN;&quU=Zkf>hxW4#|=#zZIgn!+LD{2N+&gZX7T$#$V) zns7|#aArMm(SwNg*ioHQ$I9<^pCIk2`vVO7fXO9RqdXz~zH)T#r#(*B)VDqE#98cu6x*LhsyUp?vJB+V{ zVy{+@kNi-n-DYpG8k;s~;@xF1;=dU9ZP)3YceTGbP3Vypdp?n||0`*}bXLR``_WW? z4j^G#xZQwf-RT*EfSssw&ANFVlli3Xl{Kgrrj;AAb+U-*+IR6XE zGkGop^`1I_gW--C?B0Aqvlpt}#4Iy{84Zpt6}ZQ%em>%ymw)&@RUS<9VDGk}r~!W? z&#+I^o(zc;fbgChvITUj>bC93I|8Rs7F`a`>G!`$oJ$G@Dji<@TYqC|KNLYX$Fn0? zBHnTK;$UfB!8gt;h{xjFd_J4H@{wC3Me-L?Qn%DS%QZbyHSx}($}P|JNA7QPmrO(6 zG*`9PTU`n^j|-(>zNe&(*|u$iF&({rwAEJQgG~k7QoeBadb4f%w3FQ-BHPg!(%H@W zvdH_S)Y7YHldn%|L_l?b{*iUVH>AphLG%=UZ=RWLEdy)es|h-P2@wD6G|G(p>J78Y zpC_iLO&^uNB2S=P%V$g}r&s_OjMVFMtI#f(|jD@@BPKF%4XOrUqsN~Jj_ik6*b^)%t| z+?Lr~j;4);Oql9l+u`^2S{peQJ)5i~1~~sz(YP3rvR8+{-F|KJZayvv|HIl&4`qW% ztBR>}$9lkDwt^?aViiy8^3Q*F^RC)$qQ#E!{%meN=wXyY+Sk& z3i+*708BAv?y?o7&Swc^Zu0)ew==%q{3VQ*?TWu2AopCgF7BA6Aw}93v_I!^%hbvT zP$Ib{zfeDSBPKzWq*{r2;7)s@%jDE!Lk~|l*Az(`>3ZBDVMx9!KxVt8E}EoW4jXDV_=@`f%A)Pzb7AD8#G`E(AJi8)ZplX;s?F6XAAW z5PTWq-|_sR1BGgr_y#u5@0~%8F405hf_{1Dh^^Yo&A{?k>KDq|tg_gynLIm)GtGyxD)Pm~>TCKhD)<>lBj4(IbWY{P zFjo)W*5*lHO!1(Wl(O@IefX3Yt!2MBWj`i1-4fJ)zYsGm_D$or$J7a`DPaE)fgAmG z3eHw4w$S1@c>Im+e6QY`S6So6e1oDm$})5__z;(DKH zJ8;{i7)mV9$t(%*PGEiWDWbRbrxQ6nZc~;L0XSZFi`caTB0=R>AJ^9nGDY6rPnirI z4{|8iMY2=cGi34)zs1-$>dW}p9V22}G2-E!2Xurvfy@r945peo3NUS|FrVBM;e>Z~ zDk&Z)?iYW^A_Cq|IfY98I-o1vus!W!jNqBfHQ`_Z1fgPSQ%=t(kzZW~7rzd1xhQmB zwjDO|36Ldq&s7n1$)c_Ix+4S~&HQ$QmJ`m$e`HVe77Uf2D8P8-wm&m43NJS5pz1aw z3WlB-9MfCXQfDH2!QWfPQs9~5jj2p|4zNt|)o=-Y8`bha*?IlypV|;iZ+BR2cWY4@ zf_|xK2)80{Y`lKXU$9>BjKbWXunrwOn%R5-@75Tr#n@GX8k@ncxb^yOu< ziO~TYF^~!5CP8ki&aQWEGLs8#>^dXebVYsqJt^uk`wD)vx|&cfX7#)7 z_iE~N+R;KLki^WY+ksN=T#Ip&9;0R*xek(LU;JzWRlro|swdXMFy(ZUU(m=sWM8~L>MGFJt6b(oH6>@syn{h$y^xxrj8 za7IR8+P~%YismS86aIJbdN=`-@3^D(iBHvdpix%UG=xJ^m@kh#Rh+!s!9wgBzEz6a zCf6T={SPX{nR|m2BdYfnJ8>Z)G%*BzN}p-wJ49)|;K?D{{TAayb*{M3C)oN+5h(WF zB<()OuvOSi(bg=R1fBHVBx`iGx-Ti$0&c;r{49$>&O3GYGtAwb_53<#_0^fu=E*}2 zQf{?~6QijSp=JsPQX`#>!(6*Yw|o_;sUb<=$J^nkKzMTldE@JkxbI%s;#)ivZfyNzupXXv}P(I@<4bNrS2g=+;};tB4W1 zY*3Dh^P-`1ere?Zc9{dZAX$LNxfZ6r?_V3%zBf`nq!}Pv#FX#axPB9!T$jvERhP;U zj7GLfajHv7&HYfQBGMIh3|H{%i%aJjjQ>bxI|yO1J$PMgJE~4*lNU=EY!wu%JBoDX z+&dJq@Ufhdv{Qp^-uULpGKDRr;7zHMT$CA&lKv`fYUim&FEE&Py;8~ zW5a>W9qygBBaL5ougF!psdeHr8R$NIg_{YsYihnJW8@oBe}t7eUx7d@sfAEpd$;Mu2BUj9AuJX0*WtLA#@z_No^_$0NhhJOx%9lzG%bK0@B9k>9CtgIX zEJqW~Ng=p@1)2!x^g%MIE*b#gs!$5hJ(bW#!V{m1iwdF*{>!V;@-mwa5dNFZ4%4Ak z2Lieeuf3k?Duz5nvv1YS^}3FEE+WzWIm6!F&sJjl{k27o2($8Hh4X!j<6>2z8TLxU z5�d$r`-RjFP37gIpBeUA8Fl1b5`n{z<3?bu)QA=@DDX(_LWxi^?ce4Erne-MSqm ze2VVgBQg`D^xKbH878u1uxmR2`rd_!GK?Spwrxe?ZumfGorEA4HzCJSnc208;!G~^ z)hnXls|K$`f%a!_&~=kJnGD{aYV(pRq4Lak#)aj-$bfb~D149B+W9?BU;1MqfYiZ@ zu&=}7H+ePYYMM6c$>1bO*#v4;q^aNjb{5gGaMF)W_i*(tU&R8*_b*1Ga&m+!&Qc7_3T0y`wyOl9O|dneOHwdF{BpwDiju*F-Jsv z?T12tietrHYbQc4>vB|XqVHC`pO-8l|SZ9HA zHp+FX2WHJo>05vi^y(JPadTLHA{Yk0t*WnS#U-mJ=1-w@e z5(+PBdO+3Coz~dpw($ZW`;D-PNGjpqXe);My?D(vs&Q2$97PJLs))P2(OnvnbzD9E zngELkeywG}>eC~gWK!u=7w607RKb99?=2Dd)(@h&ZuJoDXR+m@E0|DcFXjBI@8vdw z&Hlrch!+hFas)u+BHi_3Wn;#(&L-xL)o~LWd!=#?+?;LZ19z`S6*+h5?V&l2ij)p^ zRjm3}(B`b~`6uHs;v;kUruQq1+eQW0G{}$YJ=)ZuiVXRfuojUueRM~K!wz+Q22 zS^uow_h-t6^2h#F zIIXMv3Haiv+VEw~S5h#@655|(|as%6Cv=#rGiG&`dZTO~`Bdu+uJ%z&_*(|U1!M=XHOOZ8e(#_ z3R|*qChA%t8k~e9^v@ zfBB@%Gb?tcf%BYSO^&e}W9rRxPvFVA*U}ZVKe{EtxO$A0 zUTC1XzfXXab#xzetG}H$_jO7II>A3Q?}S#{fXQO!HfY32D@lQ^vE{{r{V_o9#f)Y2 zg$>U#9mupy{LH-GEPGWSOy7v?fz7}i_VzvVak;Z?T5Fu|nfUtrXwks{ zIMAmAwR@CVp6E4y&*8eWUEz&AgT|J7zaXv-9~ffeQMz#p#0-Sh_|n-7=QV z`LK5Af#-^WE4Puo(&R>Sg+hTg|DZ&>a=;ffonSjzOtCoA3$1@q)gQd^SU*;qqJE%G zvCLPRaTZ@GLSZjk#Jq~L$BB4(SQ1*LQ5$4*%TJe7W#t~a^-F}}!ix4W-O}}917WO6 zvhftw1l^l&Cbm)@_l9EON)EMpr}u%!?GpD5)WQ1Kqp_4GyKQ#qWMRqHDk3$ktm%5Y zIcn?DC-ZwD+Wj9B3AryhSDQP#u67OqM0z)?tpX@n>SGiD){AJTKzwaKmnC%M#h^|2 z;%k1kx;~iJx-{L}dAVJzS}=f~h%eez!CPgeZSthevT!7=cE&0TcCqNfc@kGU!7@3y z=!|xTE+k#gg^;27$ zJylon-iuxZkL2(03;LlR6};kcMv?!OBr#WhW`;-a9@V#tEy+mj;+roIR$%nAR--ge3Z01OUErw&T0Oa9KgS=7f<8oNiC zEcHva9aGdX-EH+Qq1Ysw!MY(^pF@2-8lePRC@eX2nY5Z&9?%R0;)ecK;J-@a7x#pI zivoK}j~c_g_G0qt46onr{~SkUe5O*;9nMvzuIU%O6k&7W1LWw8y$&F`d}&8+9HuiV zwAIk+7Gy8YvWe@I>fAcTwg&WkX3kuxpW1CMzj@i5+#DgBkjtF+TB7hIC3$xpkgZ&+ z#nXdPrI})Z_U7W{zeu7v;ZqWO#?cyT;L*k`rP1os80ezv8!Pnk?2gav;e`;a3ZZw8 z#O*EDr;Um1k(zzodbtP;+d*WH*VG^+nBa-5WJ#bjJY9vhUJT5aLJ6BFcAo2!dpahv zVIGo7!*&^{=&4Zs(7Od^3w|o}x%ymUw=DDqDg5a!(Si3Ee%r{k#JHNk0%Cr!PTO#&_Av z6i%P{i6UfSw^=Nd#*W0MFZ1KDvY>SXrhBA^#B$V4V>!Uu+<>n)k$n!wO>GvSIP{>I zHp{M8!*v^q%Q(hRLUaCcnba~~0oF_Fup?SMx?|8dDicMRrkIeqLAD9-I{HyjS%Sf< z=#IaGy;Rc;aD9y%xodwZ{E$dl7491A*<<%nxiB530M_c7cww@@d{T@@eZcmwdJkSVnP-L%{d%GUk?%CJ6RxfsH1>C>gD(s1zj+kh?(SOz&(f0}-|4yjQt5%`#cC${;CO*HEwxItLCFpv% zGLOlR!R;tJV_xfPJ#+cnZHSlK_Imi;Q#RL3ZZnL{wV_YwQOZQTS^e=gD7%_ zRHv9>ABwKmR4mXRu=aRD_&he+g*d|_2x9SGr*1MkVpw7%amrEq247!aNmnttRHRXg zJ`Jz4TfKc->`pCzP0ix8&?N^VV{=}o#owp~>)Jvo4UC2oZ7^P`WXR(w%hSIkXoc`B zC&)w}+T#1XUUm$53%RT zwMK^csAmy46)ZZsa?0NqGC@w_uX#9gx-+J28@sY=?GDsCBGT4iZ^fvtD2E#1htA#7 zynUO4`HvPJE84(l)AKV*K-Pu!rP{EPPk?kC7MQa=njWKGVo z|F2Wpg@P-|QO*|`xX72Bz8h?g!+c;DOS6#H72_NpF#jN~AM_C83-8gv8OxH{6cFi&@?cN#ET{p6mZ z1nTE6y|TA0YW4~yt335d+z3-El4YizVY?VPAR0R#Bc`heZxaLHJ-m0MpkGf7hR^!x z`_%+E{;SSbkfH27*62t0JVM>)4eY#o6InHh(p!vl}TP41g3!&))T6nP;6e4V>!XYiPTm5^s&zzZzkluA!pwFNl&)nyS;9ARLgQtpd zK+`na-CbC`Vxg6nn0clNzzMy?g@BN$G1FNg^QDn)VXlU0k58(T1a<_)uPOBqUL~%i zb6%w$7cG*W2xpA{PUhhD_733jZ~KpeN0~0Gr5BI-0P_!fQVZD6haIQl$HPf6)=Aqf z%WCUD&9MB1)vMk4>rECw3&N}5*T<$wDm-W1Vul*{hC!AZ_$w+GZQnP(u2eBH zX5+}3(1_s@NbqRlZ}gUbqfw&Hg=x3+W4%D7JC>Yn4%aB_FPBw zG~-{FuKp=As&28V=-C<8v~GisDuQmy=tPFg-{lsvS1M*$FRSxs=DQ#52OgWk1m>ih z3!OhIp?*%~W#L;iDAW4xZqPPIc-O@A(Y7jWmjHW---MuQR2cG}2|O9R>Fpv1C~fTZ z;F1EbU{5+4gLhLxC9~+CIaVB^S{?qYtTfaTJ;(qe>!8m1$-YR**P$}0j2|&I_Uu~O z6+`-+2y%@gbQloG4562yQK)}(Ow_x8G6ZH}*nZAjk~E-n-8Z1X#W1lz17f{uMj*fc ze<*Wr)Sn!{3z{AcvDimwvhS&Zw?oCMJhfg8v7Rh;@OOl=jhcGymrK~~c?)oC(BBkF$)QIcL+R>4)&<9}XN-HvyIP<{0 zgRJ*fL`fp>7D^ED)lSp+#AQ`rtn?7*aj2Gg!VrkbEI6&P-RIP$DyZ1%*}^kPpfD_Y zacT?(%RLx?xo$pNoMQQM2@?_qR+*TlPkztQLCJp+{I3`a3TppQFX&!iPY+*w&ago! zIioVEw5eF4ZWS5NMW}AqZ#J2kQfJDSZR&M}hRU9=ct8i?rglKStDz6)3 zVC2v%eb824&iEj%p}hXK?|F=sgU^AsNJlYebcuzNaFDqXGo*IlOkj-Fhgm6V(aK7j zaOh&{KHGtQ8h<*#5AJA`s@>l&Is=!kuh->XJZW>yq5v&$3SISd9iQUA)$&^<+YhP^ zoyTRstV;9!*mu%oXGF|I%9Wp_B>jdr< zl{?Gp5&(am(UhwYaHiOgGAEOtA6Vrw)lqxztXsttoOM&TjF)wP9f_gKb30TV_+myq z)*{W!9Wm1#^6wUdGY3KXzOXTCbu)s7C^TIb@-$MoEy7US7A z*AmVMO-IBSHWpR61V0ZftW*|Q!}4(50;FRf%t|J53IJM`Dk2q~Z>HKSR+ys18<}Q8 z?G3DMR$J!44er6E+I38c#SdSKKPw9ikS5eut*o%>LwX7${zdA*k^dWs#1zIznVlT=uHU;;gK$NShsh1-Bm7HakPARGism|?*4rKz z%RKp^ERsGN1CwleC`QO9IpaAb(574LEc!RhIqfoCXGX`K|G}jWxI-haKzI+pYw}|m z>s%I`;!D6+hl!vNsa0ewKWn9=4y+~KVtS;a2!$Qd+%a)d*sJG))K@9KFiS=C`tGdvwZ`<6zkx(YKv_ zv?_W$@&ljVq^dH8i;-&`SeiFbN3}ifLIYfv{#jN>>82#!iZceSVJZ ze?OyoJqH$+XdML7ZLrirY7nDVI|L;yZxO5DYg6VPNKyMPI9D|5$BW(lx+4b)AbYUMw0;l2G9m%T+ zO?mYvE+5AEi)bdO7KBiXY31X7e%j!a?pZ-WSyiT=N$QBVOCJV!t%7%3 zev>Jf(eHrn-6G}gy(f6342MIKWrmgl?yhN&i*R29>XXa**@p6QPAmf~(8C`D>ev%V z--o73o&b_V;bM+T>fgH<{#*2xuMT3HZm)@mAUm97oE6P_&uRO7SCw>UW+%TFo31{l zouA^tI|h+$&$}Xz(<6Hq#X>RXpwqr9+hblWo}Mwoi$4c6}+s{cOZdMtT>=`Kv1Rp)h^oDA8OrE9XV(F0YhftIU%SY-P6`+z-X2 zPgVww0~K8eGgK|;!T$U;x^1C~#8gf9*3>9IeRP#G2e3Ov$W>CaI-&D6q#aC!*y+H3 zT1695LV#6$m&U&~sATx2vR+V*49G~H-(pHob9vS|Fse|7NS|}7X!Tcn9IaRqNNv3D zVa^{$J1r*w_gLLVFigs3T;WbjD;ABh+6gdDu_2k#e50j<^o9jCS3)h)99U} zWClb~tXX*NrYB~a^VB!b`%b8GiV@n~^rn}!cnX*OH1+TO&^t$~+R5;*qwR;p zObwa4zmODB#)9M8Y}J1nFuCSKb8uRLMWc^kb2%B3L|Hw$5^?io)c&gqFSa0dCl!4Ho%$UC0og|sF!}H?; zv!OHm<7zW1C!Ia)$>(}uLC>Qb`$FdFc8ij-{ZJiRbuk{GNKUJo@NjN^?X}RPk**)- z6fOr%`5+r05xPIuwfRgf+&wrn{CexSjLWXS15y=73=mOo(aa>)A7jZ=;6+*YOc|sy zOAQT$x+Jz%>sD8I5JG#W9BWv%2|CHnnR>5&+_nk3YW|fF7$}+=Xm#2|J#QEL?;$9! zEo6$4M2QWjAHeZS{bqQy)!pq#JDS7KLb0p3M=8wq_S6US91L zl3N@CO(Of_0ugTL_#w)>YUJCsr0^gd>e!!s7}%%OUf$_rlxvZeCT7gMm`>a0Zjb=t?|JUAkMK#s6-C9t< z0!R@R5fJH0lOnxICjFvvyl+J@c7!u4idn0CKt!A>mn_&nsuQd_9->6BgRGU3-frUZ=|c z2N+XQ89agp6W4RO+?$HB4o%+}!;YIuO;@Tn+Z}h!LFgwO6y@|L;uz6ZMuxrH6O$<8 z?+$4|-SFEr`2B}Xi=za$j@Q~2a7w4}CE`W5a(d)8l{cP&W9o6if0-I zc{LutWOr(ql4)0zJ619C6{PGB*W#4U=3!P+&pEn(oGjni1WRI%r=TCOympyu#V*2G zpjNDx>Y2*Tho9|sZ}yaG3w{qzIn?AsOQKF|N!n(vaBJL)2E@@Iykbp^N;{BSr zvDgatp?OGd0czMAF9dAgT2N%O!7E~YBr9bZeYhs$=bVT| z=Oyp$&=zy}(5Z!Iav4?8pxm4U*PAZv$1(Ix_Ec{^_f84<2nf;74f4uFL2M5B4{V-t z{J52wYj(CbjcA9`G>WA$eH9S29b8g$SiAy#RyC@&|)Cq61Adv!=H?+ ziID0QYuNL%=8@SDTG#r!PYy;Asby2%w1Q@i+vYy>TZkRD$`RvAju8o@2L+9c2zfp` z;ZtLjxrCq1p+%MUG+Ky=smtJ;z~S$-eG)o9U6Eg=GPGjj{eI;?!utkCU-|f1kVD-qkx_2?SN10NmWrImp3m~Ec)YE>+Ez1HqtkoG9&os9 zy6MC7vo1^CCfTzFz*8N5X}~5!G0wzQGDMiD>#~|?c5(AO$_TPDVoQi809@o@V7Wakz3t?B zw<*I>b*0Enp)$m$to7lx2YrB#6y;SzwlbWiPNiW|{kVa)ntVg>-Va~_^|F7yHN!BZ z!cE%co?Pa&dmqxRcoQlJi~5VtmQfNvq+lzaOnK(4Z)VnV>H;7CvvbZ-3D8QL= z!lyv`*r@DH`iGbv?-x!b!|w^UmmB?RxK73Z^2G7jVk@l#=<$FQcAjaB!^Y_ zc&^oTo0ST^PcP5 z_j;IVV?1BKYgTqfJ3q|({ES;$K&tR@xV9Azci+M|we5F2o=g?Q2Br>R6LLr%rWb|y*Lc9^}F2JrG zGOUY~{K~%ssM${sB0ZikpqqT#O+7$Jq{wAI=BGzfQcQkZwoh(1$Ef865hnO_NL0JC zKd0Xk7ygjR$@!vT9Hz$qy2m^slljIrA^Q$BZKoL>CHyTDPa&+4GxYA#qax6I1{aDg zqY$CFsh_ryCA=kSAhm)o7cxtC*FH#o!zd*xo~1>qE5${yH(w5@V2K-4`%kV#NkSp+ z@FryRO0g^NjRk+ZNHE&?dB_B!?>fquA+rtg4A~-5<+*{1zxQo$dX$t_CYh3yJl#>+ zs<=ie2gYg=Y!rNBa^#DYXC>nddV@mzm2AxRKCF}Z0muo6hq`@=oTaFToy*O`{7H2w8+b)+Qm z&DBc2qKk1EI-Rrh7Om)2gMyCnn=^Cx=JPFDVT~T{wq_ZDg!sUhKWCA4;yJ zdR6M*uR#tg8xDYsD7Ou}`B$}XD0Xa4%(0R^Kv{yR_cskKmR@CcXC8UY?iiZIB*v9Br=` zfqe!e7|_@e4jj4tH`uohaqpufN7-|ve#8#|UhpLdd)OEYvQSyczP8?vw|`yMJG^Px zwheOaqg`*ai%=X2*1k(ax^-_q{2N*9JSBmvV)xDE3ru!u(r$7rhTkj=lTyA`Ki5hU z7{9NlmmI;)!#{k#8I_@*>yYI8Jwneu?q20=ClE_s54YAz`Cb0+(Y)P1^~-ZNZhLyvG;KyP}z0)@-Si%T;X zBLRcz8Wg$c_!9j3KHsHF$f`gaIPfQJ^M~oz2i5r2EaIsZWtLM_{tGX!AQEzCUFz9% zqie6S*BDpayL8*oB2YhV=e|p7Cz(I{7onV4Ef}!#<#>C>`S zWGV;kop-Ejd3M6leH3@K%wYX;H^V?~WCs==uSY4dhNZ&(5zoYXniLGKfXxLQKVCyB zT#=dxl0Dgb8w0TzyU`oqUlUk~Hxzgr`oh#OgTcZoARSinBc{|lDk^y)mB4*skZe%W zqw_^vv!0-rB#{3)U((lq5 zV>?TtqkjK&1+aRWcHd^Bk=0Y;oosg<=Z#q!rm4%6+xWLW4SX%!?}NK%!IwG&x#x#t zq$#)F9zEhi_VeZ09dNgzs72C4oTcD$LUhywb8i0m^y0e!&@8>uzg?-{n*zr5*&G4(Z<{`sv{n3TGP17-dNm{yFgXFGFl^ zp69MZ!Cn8|#u~8P20}{J@cTUfv?1#TJb>K8akR_tICtv7|7{zR0AkSi*~k3<`)tfw zCIGZqKHe+4{Xg#yIP)k45VPIST>C@r|I@r~G+;pZzrEx`DZk{SS&qH1=-PWn#B~qk z_{7U@oCZo1FHgyqdKw+5CX`q^O;F^f=V~w_6ux!2HPsHI=4vO4JAAha~$T~CV?^MgDfan>s`g)kBNf>vv=#KHnIB&OP91M|dCbT+LA_b?f+@z!kT116iTq3lJ=C5inB zR}dv>2N8HfMJ!YM!|^){@fg^oQ`1!uIANFHOAv~YTp2DfR+upH-0oAL{E0vk z*Gvo_w@Z*G3s|&{l5-^Vl>i%W2F@NseRksC8ic*^ZeqYZFY>|VtsNh306QWsNbGe# z?0qL1aLa9ZC{I5r@cij8VN_+t1xK5D*;SgU%fff!u~&Q<4SRM_>N;EQ`>$$C#5X{0 zTzRa=RDkt?N~0$JfR__Yx#oK`!=%uYOc>14@QuqVAl=`s@TI3U&bd!1v0A*@ht2Ij z**GC0`4gwon26aAOsWTkxN)iUb=gk`;bVN{nWtC3$9J;L2dPk;76^WQJc%VH!nZz| zUD@KRUQA`?HanW8kI&?qfbF2%w_4~CvGjhYgV8Cr2-|E_+wcBf~2{z8ap0+;4OPa-HyZ~44XSRqWP z(Wm*EvJid$_A?@Gy5$q3@0*-^pByQK#%67-{CAC$aIo~vMz9R=6@!?|tjLxSP@vwd z#hb8{)%5vo+86Ooc2HbIuk>iKxdNG4`OBv&MK)x0uhH#c+Y_cHLd3%l97)BBpRWI$ z3Sx3>WAcTm80TwD4`is*OU%buXjm-=#CG*KG#ym6W+?nleW?qDt2_E!S+LA&~|X;JL#(B@hy+dB?v z>BQ7MnUfuvlxHUAr6=#ru3gq-7~o3sVIY2afpD5?4BT8xd~Y9eM@n9d_gw|O)H9yy zJ2mcWM)r=MmggC@+E-Ya@a^t9ch8;D5s56DGfXFsCTw6PHYnv%`)cH}!G0%CVP&dS zRP_kY(ZfY#_pwQQFo>Rlcm}?iL;8uUIbG)jMpeQb3&ACxN(JpAu6j8 zLequ~9G1p+fGcXHwLM#)W^IuREGgW6t5K0JyQ2B{l*Z=`65*vfw}{fYSx6#;V*WHp z%LY-Y5K&?a3E>M1X(v;dnKZd7vn^)w%vUnF(Adq*Lw#SIe$}YghBr2zLlypIdPS}Z znBj$)o)*D@>8c1Hm##JZ=Ir^GU@4q#Qsxl6K2oK>sVby3Nb*&0RLpkHRC#}zGO0}D z5~~%98ICQdXSr#zSd&WHqU{Tc=$3DDj>#_2k zs+ODG^+@TD^aCqt?TY)}b&@r+Vd^g(6LRO%Y&{cwj(3t5?8d}LpEQ)E;hz4?O&;TL zo=vkB7A4Ro8S3sg4`(44hID0CO2P6mgabr9u0YsCW;%I#g`pvWbv%obO5gK2*?vx5_v%KX~wH?XW!#1MgbvDBK)U|wyvm>G{L zS#1Xy;j}nhrUK|ij_^VSPOf0LVbs&Rs*cJ~ua*k8W{|jmo&7u2G%3X=+bd=#;)5nk zUJOxVZ00N1KfHv(W*A)0W@u_b55w$-fP#g3{v8D}L$EPr(?E=msSke6yjdOEr5#j2 zA&Z=mA);l52F|}-&ZsVH!_!6u3Vwt>!6~6f$Q?u(f*Vb|*UE*Z-efyS890EQAfh^V zPq}bgxgS|+bLSRFWe()-D5S|QB|WR%&m>c9NWaEB=@E`zeG?%vx$p`8g`j~-P|>6u z^xD*moB1Na>xqB~46CJA3M7BkgO^!5+{=36mApsSc+YG1oVvgAoXTe*tp2AoMlWj> zO?hp*IAwzIkRmZ?dT$BM!IYzhKZwhs%G|v7=HoM1oDqm`GEB#S+Dw{F!V`h7OY^r= zURlw(v9prlNozmX8Hw+*_^>%^dO{cpazEUy**qtJw-?&^^_H?HmN|wx7JkUkPzF8m znF`n61qVTbbYDjLo~622fBN#{tj4 zfVca|6QU<(=|Qx=$8M&+gR$~NdiZk}R#M>);nT^P7}akFwez*>j)D>=jIcr&$Y13? z&RrYL5RN8G%2eUhfQqA4eto&bKF5)g;8XhIrfPmpDd>fGWYJPI7bq?>w9yEzZkuti zWbDtuxN?}d0kg?VZvfBHDGTBPg+SyFK#zat*NOMOU3)bd{VI9ejnk92{tH*~o#Ewx zC)65VvLj^hQg!sM5P?~L)io}wo$Hy-H#A%j6yWHV3}w^S6kkgJs+XpQ(tIfUMRL1+ zv*d}JmbV!$SAXc*z6Kk%5uh zzRD!%oR}LN}?0mUGM$*`Iv`q4L?Fm zs!XIvUkw@|r1jYnQ%B^fOt1>1H^YwQR?YxzQ(4qnsPY}Vm<6-d&!0SB=E{dA78=j# zz`Tt=_X_+DJ#61{`s}!kybLpr?-B8UQ^)7twQoKJi($_P2EXg^*1dO0yUbEKx=`jt zp6>nZRw!5pWjwhM{-#e|Uaao1`dvlV9f@h7^N;x?hT3d{ORb&L4~ve%?2Ddr_gMDF zCF*JN(L4=g2qtS#Z<5#{(14jsZ%Rf{Y5K^g=j6{!3 zG?&rQd?=*-^896H4K&Gut+!|qK7{Y{C?=#44*QDnAVKKI5LnEoo8<KWtfM+z%~`a*F$7zkc_7f0iE14b5QoCIIF454&9w~x_SIIzhSrC z9IW#jaYp9Yf@~WBzdAg!UISET0=)#6x(eJ7nFt?Bn@{Yd+i#`;J7|U(S3O~HZ|-;z zmQQH6D`GYLtRCOraV|8UwsRZY-;o-c;2tw#-H6hR=jcqY*w!KTN*}Jyb4tK@R}?$W zg@HNveOD?$rX9D!e2Uh@Vq=GdGexfN?}t6*+~|JG#<}HW!StX2V}}eW@+Gd!>*#g| z>&EopY7Tdw>`=hGTWBbNl=Isp$?nGAamD$;@^C5b^=Jwhx0(1AthE2vWOZg? ziOHjQXtRWO_#W2<_R!fhMsx5TNUhN;30E{vCe)2){AYaGWBE`7GDj%3>lm|NPv4!_ znSKCZpOfpKdL?4@a4Oe`4{Z5OmebyJ!8vv_ zrm;}S9IW1Ja}U2UWweVZoQK|fi}wb;T_HdsnS4&+dM6p}#*meB7}E6D;#{!l4?2?_ z&r9K+4pn-54V`z6$JN5OAuBaiy%0M6eI2t;5u|MBNv|!g@X;1}6VG(_JG1~k%TuTJ z=q&MMl4mlvw^3!Jf!HjspxNGvIVIQM;GRnJHb=_U(GGTLtRW0)3kOQy-CePA=E+)M zn>bc@zHi!cNQscbP}ji+Oexo#r76dKfFvUZtT4)6jmec{LX?WynKfD5GJm2xy;86$ zio}EJl^^H!_Dt+*8^Jd^2%j!B1n0i-N$|hie@X&vKC@=CSIDpB;M?M{;L| zq;E^iz&aDz8V0!Ql&&ThsY6ZB+2ecLJ9d0>{9H+UI{;M?a$^brFy3T~N%_Z*HRV;{ zx;z}d$x4iS_Xk>MQ2z3V%VjQ0eq$r64m7LizQ!blmNRQJY0?ITPvc%pOn;AOrM#;N z_gfyQHLNrh&w+cHXVk62F2Pj_gS^dT(8bZ=*06i}BIB$92*R-RyN;X<#~})Q7oK*P zpN6dkOM{irF~hpBt{P_?Yr$)*b!iXhUV+$r;u`KgDZna^H20+_FvR8B#P96|T_qR$ zX-_^FM6)->t^Hk(WFVfRuA^T@ZBjD+`K0||(fMo1Sc;!)oQ z+xLQCCY*7(iyh$;LkU@fm%aCVtc_7#PQ=F_@d!QIEg(ft;yVk`jW>N z<4!PyVZ{7?iXJhoNOWx8PoJ{Ej&(vWHN`W^Z!FAOb8*U;Z)j{~w-NM^YPPK3u@v1+ zA)0AXpV=v7tUyF2Y(NH?qh>wOAkihBN?I^S4w8#O_#;>MJeYzkg*yR># z4DASXPbDV#^2zL=D!-tM-_x&#Y}D;zsFDtresbfsmPC0gBuqFIWxnh~044ywxsR3^ zL|us#M&TKD7si6?A7qK+eN4>hUCF1cv&yxRgrOpT52FRP zi;g9t2lQEbnPp3m#GbB9LPjO*l%uod^Lr&TtjkS|tOEFsfN0rEC&UfkWN?b+R(XXk z>y+0PXO?&7`bJ#!+(oig;UZ7a$2ed6t2SF1VbHicnan)?rs8Xhw)N194BNv*;d1pm z%QBNO3S{WPnrVVQ>NTf$!8PJ9QkfX6E5?wR#oU&3_iji6BprdRAmJ}XhqeLNb- zXZ+BTnoZZcD=0SCwC^MPBZ$WN@Wxrgsx5WCqw+DEoYC7SZOLsAtBb<1q+mNsMb5c3 zXhxXFaREG*cAc`e;r^?S#uM$}P`dR*g`{Y#mVecnC1X1@UwCbemE#kn;Fy+O9nP(w z7YG}aH*M%R2NJX^tgUUje5}|diGt{m7+UN2jAa)|@fvo7&!ty9%l)(+Rpl(kB-gd? z_*Ib&NxoocyRc&!wi}_N*+GOi*!6T{XXl<-TD4=f=FRP9jM(lUw|>mRYVnpob#s}y zU8N|#)~hQtv#xVZ{-{FQQWcC}1aCzKC4@)^NR`hPVO8RPcH-O3OwBgBU3~+V2)Hle zvurEgzvVziIazP!j6+=>onDkx_KC)p)sQZ5Vd}@#;FUX>b?&nZe604>z3c$!qb)pE z@#e#m>DCuC8`>mBZkS}h%3+GgS)Pq6nC-xtWeXdy;I0M7<(FktFD2!{>FJ6V`93)c zhOE8dZhnePB&<)jE-xc=ObNsF@-79-snR1?Z_jNJ1FS)Md)hLY?)0K=4_ubs*FQ4s z;2A~?Igepp00=x)2pXScGANSFc5N?5SFFT64~lE*(5Oo?9)RZXZ-xH!%-E-o_4G05 zxEwtsed1@h1>fY@MKDe=rGjnjE6JmUTd*Yo2V+i})$>n7dNzv8RR&_s z*&mu^a9Zqgg_>8INEW#}F=2=1JGC2`N^+O@FqNO;)E5d6v2A|Wa?a`i) z2VtgR`0gM{Z=7iTbq+9V3WvTPeI4iF4^rtqEqW#tdHf>bRkNfSPV0!Pt>HN2{pKG_U`RY6$=Em5|KqZm^86T-12sc)AldIQ(ruTWe9Zkw{ zX+@sb8|^^2$)3Zh;J6Mo{Z#{ioVKW-f~$zJPL<<3eh+~(=@@?{{gefo>~0R$^cKr@ z<*9fIJ>GSHlBR{yWFQx98;R$Eyvyt7oI@YA=6YHf1aEdM`N={x*_=Mkt#|-s7o4%# z^Ik&9D`%Utm}f_Vw$bIOa3P@=!<|b7lX9etgIX1ZSUt*X1p_m`eX1VRD*j7DMLuqv z!&#O?Ft06rnP9G_~$ zp)SI`?#)x!kRn7En|bUB^^nju6A1r-ZZ|PbFfKPdbg~0yemR;nj(m$vV(C+DA-n|^ zne~2pvqua)d(oGQ@_O&bVXGwl)_`UonoEb0Irj~-Rd}X7yuD z>}JbX;m3ww)pzp7)n-J!(06XcnPIu>=Y6`)1l*tRNI2>_R>H`|bw}BsEgQD0x?!JZ z)bR0Zr{1k{6Z>JIw%fmN70UVz_sA%G+MmlHdeW3wX5DIbDZrLDM&odM3SicVA+piL zBGocmFjb$zYvas3iBwJL+m0oTQTM;QJx;25NJ;)lHJrV?M#Zp4eRyXqygh5>0*mf- z{ZDUk`>@2v&O4c{kh!Hat%fn3l7m6LXN~{rLO(D{XLvll$NA*p|9_a;!>Zwp z0?R4>^ZjTzNsr9QQ8Alx9z4ouNS&d)S}uSe_gdMSq^$F@4B#x@U;|u1b^C}E>wkou zKSsPe>^~xErH;;PN&c5aRJ>0O=%IDUtHQs<=YN%|J$^tVx^sM%^Ui-uN8W(^w1>e4 z#{G7v{6~EP{Esnb^tSglDP_0*Ijip5A3Ua8my7|bQY3gt`t8`OXTx}2fcIt`TXBr< z77Xcyue-VfVB=>1y{RqJ(J#`j)G5ldWMyxGmd4J0;QXf{*v7)+cMmpC~h0g|mY$wQ;?*Nrn&Kf$u&+3pH4L5o7=SZqoOJxOb|V z#0Xfd&W3|2uv|Vnh++Fl=QhTagtrvp?V5jBeoNOfr+UZ9YOP_`5Xl!(Uc1FJAu`f~ zIrbxkSGN|rV=Z3ryRVM^@&#lkgOg+8S_U6H2M1^=EW8|4i=4o8_T{ds^uLeemnXFW zKzO!K0aBY|yDEAQkU+|d;HV_;^{PPro58OEqSF3U=O_S(`m5$Bj<~&jKT6n-B+vQS zd1i^-K7}T)tcN|1Sl^-IMSC?Rx0;z#3+wibyzyOTnBt4-b3UsUOr>D>vQFmAY?x5M_O zD}~j|+`nZwvRAZ#s;wM)kLh1kwK$xlENUqp zdz7gf)2^C8J85rrXoR-?`0j&}nUK-Wpbq#a1TkrSOMpNaLEcgF!{B>7u7?ZX#(Hnm z;f0V5Z%Koed=-Ky%2$ez80+37Mx{i|W}xWk=bH~3v$fS~?a-Oe>%j7BVd}i(sjE@O zj^F3HqQ`Ay4u5JDl7vmnqv92A`T~qitJH4^+0R7d2jKQQk}I6Qo8dm;+&1T{eB1dkDl0O8KfrgICfPRo0~ncC z#ZNXR9fzixSGxPsk@@bsL=TLoXUygNUkiHME;95A4NyR05~i1^LQ+WY#P+`9kMuoU zLj>_N1#}W88qH7_G?J9en}R4Qr=)}V_dQr>k6`I}?mH;ag=5}|m#6fA!su5Pg_pef zFQrp;bxd^Ut)flzTvH<2_T8QdC$ryZoRC#oKWP=M7dYTT0WW7hZfpa6+5W}5w?7K+ zYB9;+c>Ysw;dc)$wkNl}6+66~E>oav1jtvWw!KMG44EYb2H)?--1K;2ZfD7^I7~>4 zu3NR5DvMFR#OGt*IhkjQ<38MuM&8cfq-(b6>LALGFpg87^X7uTFRKxUHKS> z#(-S}KlyxNK&WW4%9$NB(yz9&hFnRL6LfH%i_{N%!d+lU0H_C>mmV&+BE0||lt~j> zITgrHh-};~5IPlZ8*PVJf^NSEV)A({5Mx31it}vdtQ)7M;Q!3T5Sp*%q#u%JPi0+d zM!{^Sg+z})H*urnv?X_=__QStg1V-^{aBgZ6xgmzPeoJd)|ktwT($EYlo&7OYTa(J zJ=-y#rsipo2P=!p`N^h06GzRNg;R@D;)rh6ebgbXDX}J`W7q+R@xr%X`f`JQ+PhDO zC5-VjL??V{xk&0aDF-+fBsg_0{u?#g$r4;TxrSdBgn~IPUA%TGaa>e?WrU7Uim-em z$0{U4TmnP3rduRXz%x9`fCIDXcR+IC%ZI;&Dv{oK{Y&Ht`u*4C2U($l1s-AHbaiWD z1r1?3-k7}#MEOko~rG_^Y>eshyX^AU?dhyFrQSHNmUvD>?plF0u2xu7VHh zS$TuS%Q=FTaw`z3Mcr}qjO@*ygdSmrNZePKu|wr7zW+`ITIT1B;%8b}{GY4cs0UI; zAmNqzP`{J7F$(Aigg{~#AVy=~Wfx=)WJs2Ago(69hPM;?Lwqd97`UpYb*n12Rkw`c zU7aQ+Mp;~e)NYDdT;75_>w$Mx0c2GU_zYOyOBt>n4n)`MevV_Zmx>&=n_@2JAb-AV z4j#yI_@C=wcA9h>`I)Nt$scTlh){|vyVzcU5q{4GIpB7ka%qtY@mHQw(Am_kG@i1j zQvVqBS$OeL3wrCzqhLb%RjYD+?NanB*)`S-c>KM0VL48acZY!WK}ea>oB!$!e&(3V z^z?uo7MKaqNq50j|IG2aVQ-Yo?mZvCPI_P=)Fg4dS)ue|!9r{+9*%($2VC`gf@+#+ zN*}{TQX*e-yK+$m*zb&`9kZEc z#ielp3`VG!r)VOFU;e{4#^BMI9$@h%`g;93cUAG)A$Pkqb%QtBf13gX|_F zmeXA3%C4)Wf#a$a^ zEAL4t9(}`EL?6Lv48oTj4L_l2C4=klal9p?zD}(qnCaB@05QtwF>$SDj?Xzo(lTW| z#P`TTC8|>mORYd{QcvzcHlh;wIDAi``j`LZ)$eV0NF?n&$)CO*T}?%$YMZCaRC+bRGMW)NB&nqEatrRj3}=Rhv`$sow91 z`=*4k43w(U)%)(q^%+<}#(gfajCH-RGXeI$Oi1E^Z%9J-GzX+Lf*9Rnf^UntWC;%6 z%DMT_I%fE`9jl??VFJKm6?vfBVB(y%^CjY41aTmzd6HS zZ1kV?WdGkW;;$2gSo{6A", + "Default": "/cdk-bootstrap/hnb659fds/version", + "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store." + } + }, + "Rules": { + "CheckBootstrapVersion": { + "Assertions": [ + { + "Assert": { + "Fn::Not": [ + { + "Fn::Contains": [ + [ + "1", + "2", + "3", + "4", + "5" + ], + { + "Ref": "BootstrapVersion" + } + ] + } + ] + }, + "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." + } + ] + } + } +} \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.ts new file mode 100644 index 000000000..c3202b758 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.ts @@ -0,0 +1,37 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +// Imports +import { App, Stack, Aws } from "@aws-cdk/core"; +import { Route53ToAlb, Route53ToAlbProps } from "../lib"; +import { generateIntegStackName } from '@aws-solutions-constructs/core'; + +// Setup +const app = new App(); +const stack = new Stack(app, generateIntegStackName(__filename), { + env: { account: Aws.ACCOUNT_ID, region: 'us-east-1' }, +}); +stack.templateOptions.description = 'Integration Test for aws-route53-alb'; + +// Definitions +const props: Route53ToAlbProps = { + publicApi: false, + privateHostedZoneProps: { + zoneName: 'www.example.com' + } +}; + +new Route53ToAlb(stack, 'test-route53-alb', props); + +// Synth +app.synth(); \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.expected.json new file mode 100644 index 000000000..f8d9f5a95 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.expected.json @@ -0,0 +1,930 @@ +{ + "Description": "Integration Test for aws-route53-alb", + "Resources": { + "Vpc8378EB38": { + "Type": "AWS::EC2::VPC", + "Properties": { + "CidrBlock": "172.168.0.0/16", + "EnableDnsHostnames": true, + "EnableDnsSupport": true, + "InstanceTenancy": "default", + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc" + } + ] + } + }, + "VpcPublicSubnet1Subnet5C2D37C4": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.0.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1a", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet1" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet1RouteTable6C95E38E": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet1RouteTableAssociation97140677": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet1RouteTable6C95E38E" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet1Subnet5C2D37C4" + } + } + }, + "VpcPublicSubnet1DefaultRoute3DA9E72A": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet1RouteTable6C95E38E" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet1EIPD7E02669": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet1NATGateway4D7517AA": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet1Subnet5C2D37C4" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet1EIPD7E02669", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet2Subnet691E08A3": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.32.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1b", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet2" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet2RouteTable94F7E489": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet2RouteTableAssociationDD5762D8": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet2RouteTable94F7E489" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet2Subnet691E08A3" + } + } + }, + "VpcPublicSubnet2DefaultRoute97F91067": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet2RouteTable94F7E489" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet2EIP3C605A87": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet2NATGateway9182C01D": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet2Subnet691E08A3" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet2EIP3C605A87", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet3SubnetBE12F0B6": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.64.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1c", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet3" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet3RouteTable93458DBB": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPublicSubnet3RouteTableAssociation1F1EDF02": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet3RouteTable93458DBB" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet3SubnetBE12F0B6" + } + } + }, + "VpcPublicSubnet3DefaultRoute4697774F": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet3RouteTable93458DBB" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet3EIP3A666A23": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPublicSubnet3NATGateway7640CD1D": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet3SubnetBE12F0B6" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet3EIP3A666A23", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPrivateSubnet1Subnet536B997A": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.96.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1a", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PrivateSubnet1" + } + ] + } + }, + "VpcPrivateSubnet1RouteTableB2C5B500": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PrivateSubnet1" + } + ] + } + }, + "VpcPrivateSubnet1RouteTableAssociation70C59FA6": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet1RouteTableB2C5B500" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet1Subnet536B997A" + } + } + }, + "VpcPrivateSubnet1DefaultRouteBE02A9ED": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet1RouteTableB2C5B500" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet1NATGateway4D7517AA" + } + } + }, + "VpcPrivateSubnet2Subnet3788AAA1": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.128.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1b", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PrivateSubnet2" + } + ] + } + }, + "VpcPrivateSubnet2RouteTableA678073B": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PrivateSubnet2" + } + ] + } + }, + "VpcPrivateSubnet2RouteTableAssociationA89CAD56": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet2RouteTableA678073B" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet2Subnet3788AAA1" + } + } + }, + "VpcPrivateSubnet2DefaultRoute060D2087": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet2RouteTableA678073B" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet2NATGateway9182C01D" + } + } + }, + "VpcPrivateSubnet3SubnetF258B56E": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.160.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1c", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PrivateSubnet3" + } + ] + } + }, + "VpcPrivateSubnet3RouteTableD98824C7": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc/PrivateSubnet3" + } + ] + } + }, + "VpcPrivateSubnet3RouteTableAssociation16BDDC43": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet3RouteTableD98824C7" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet3SubnetF258B56E" + } + } + }, + "VpcPrivateSubnet3DefaultRoute94B74F0D": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet3RouteTableD98824C7" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet3NATGateway7640CD1D" + } + } + }, + "VpcIGWD7BA715C": { + "Type": "AWS::EC2::InternetGateway", + "Properties": { + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc" + } + ] + } + }, + "VpcVPCGWBF912B6E": { + "Type": "AWS::EC2::VPCGatewayAttachment", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "InternetGatewayId": { + "Ref": "VpcIGWD7BA715C" + } + } + }, + "VpcFlowLogIAMRole6A475D41": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "vpc-flow-logs.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc" + } + ] + } + }, + "VpcFlowLogIAMRoleDefaultPolicy406FB995": { + "Type": "AWS::IAM::Policy", + "Properties": { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "logs:CreateLogStream", + "logs:PutLogEvents", + "logs:DescribeLogStreams" + ], + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogLogGroup7B5C56B9", + "Arn" + ] + } + }, + { + "Action": "iam:PassRole", + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + } + } + ], + "Version": "2012-10-17" + }, + "PolicyName": "VpcFlowLogIAMRoleDefaultPolicy406FB995", + "Roles": [ + { + "Ref": "VpcFlowLogIAMRole6A475D41" + } + ] + } + }, + "VpcFlowLogLogGroup7B5C56B9": { + "Type": "AWS::Logs::LogGroup", + "Properties": { + "RetentionInDays": 731 + }, + "UpdateReplacePolicy": "Retain", + "DeletionPolicy": "Retain", + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W84", + "reason": "By default CloudWatchLogs LogGroups data is encrypted using the CloudWatch server-side encryption keys (AWS Managed Keys)" + } + ] + } + } + }, + "VpcFlowLog8FF33A73": { + "Type": "AWS::EC2::FlowLog", + "Properties": { + "ResourceId": { + "Ref": "Vpc8378EB38" + }, + "ResourceType": "VPC", + "TrafficType": "ALL", + "DeliverLogsPermissionArn": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + }, + "LogDestinationType": "cloud-watch-logs", + "LogGroupName": { + "Ref": "VpcFlowLogLogGroup7B5C56B9" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPrivateApiExistingZone/Vpc" + } + ] + } + }, + "newzone1D011936": { + "Type": "AWS::Route53::HostedZone", + "Properties": { + "Name": "www.test-example.com.", + "VPCs": [ + { + "VPCId": { + "Ref": "Vpc8378EB38" + }, + "VPCRegion": "us-east-1" + } + ] + } + }, + "testroute53albtestroute53albalb7C171F50": { + "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", + "Properties": { + "LoadBalancerAttributes": [ + { + "Key": "deletion_protection.enabled", + "Value": "false" + }, + { + "Key": "access_logs.s3.enabled", + "Value": "true" + }, + { + "Key": "access_logs.s3.bucket", + "Value": { + "Ref": "testroute53albAC463A50" + } + }, + { + "Key": "access_logs.s3.prefix", + "Value": "" + } + ], + "Scheme": "internal", + "SecurityGroups": [ + { + "Fn::GetAtt": [ + "testroute53albtestroute53albalbSecurityGroupC3716E02", + "GroupId" + ] + } + ], + "Subnets": [ + { + "Ref": "VpcPrivateSubnet1Subnet536B997A" + }, + { + "Ref": "VpcPrivateSubnet2Subnet3788AAA1" + }, + { + "Ref": "VpcPrivateSubnet3SubnetF258B56E" + } + ], + "Type": "application" + }, + "DependsOn": [ + "testroute53albPolicy478FC0AF", + "testroute53albAC463A50" + ] + }, + "testroute53albtestroute53albalbSecurityGroupC3716E02": { + "Type": "AWS::EC2::SecurityGroup", + "Properties": { + "GroupDescription": "Automatically created Security Group for ELB deployPrivateApiExistingZonetestroute53albtestroute53albalb73DF0A20", + "SecurityGroupEgress": [ + { + "CidrIp": "255.255.255.255/32", + "Description": "Disallow all traffic", + "FromPort": 252, + "IpProtocol": "icmp", + "ToPort": 86 + } + ], + "VpcId": { + "Ref": "Vpc8378EB38" + } + }, + "DependsOn": [ + "testroute53albPolicy478FC0AF", + "testroute53albAC463A50" + ] + }, + "testroute53albAC463A50": { + "Type": "AWS::S3::Bucket", + "Properties": { + "BucketEncryption": { + "ServerSideEncryptionConfiguration": [ + { + "ServerSideEncryptionByDefault": { + "SSEAlgorithm": "AES256" + } + } + ] + }, + "PublicAccessBlockConfiguration": { + "BlockPublicAcls": true, + "BlockPublicPolicy": true, + "IgnorePublicAcls": true, + "RestrictPublicBuckets": true + }, + "VersioningConfiguration": { + "Status": "Enabled" + } + }, + "UpdateReplacePolicy": "Retain", + "DeletionPolicy": "Retain", + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W35", + "reason": "This is a log bucket for an Application Load Balancer" + } + ] + } + } + }, + "testroute53albPolicy478FC0AF": { + "Type": "AWS::S3::BucketPolicy", + "Properties": { + "Bucket": { + "Ref": "testroute53albAC463A50" + }, + "PolicyDocument": { + "Statement": [ + { + "Action": "*", + "Condition": { + "Bool": { + "aws:SecureTransport": "false" + } + }, + "Effect": "Deny", + "Principal": { + "AWS": "*" + }, + "Resource": [ + { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "testroute53albAC463A50", + "Arn" + ] + }, + "/*" + ] + ] + }, + { + "Fn::GetAtt": [ + "testroute53albAC463A50", + "Arn" + ] + } + ], + "Sid": "HttpsOnly" + }, + { + "Action": [ + "s3:PutObject", + "s3:Abort*" + ], + "Effect": "Allow", + "Principal": { + "AWS": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::127311923021:root" + ] + ] + } + }, + "Resource": { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "testroute53albAC463A50", + "Arn" + ] + }, + "/AWSLogs/", + { + "Ref": "AWS::AccountId" + }, + "/*" + ] + ] + } + } + ], + "Version": "2012-10-17" + } + } + }, + "testroute53albtestroute53albaliasCCC6DDF3": { + "Type": "AWS::Route53::RecordSet", + "Properties": { + "Name": "www.test-example.com.", + "Type": "A", + "AliasTarget": { + "DNSName": { + "Fn::Join": [ + "", + [ + "dualstack.", + { + "Fn::GetAtt": [ + "testroute53albtestroute53albalb7C171F50", + "DNSName" + ] + } + ] + ] + }, + "HostedZoneId": { + "Fn::GetAtt": [ + "testroute53albtestroute53albalb7C171F50", + "CanonicalHostedZoneID" + ] + } + }, + "HostedZoneId": { + "Ref": "newzone1D011936" + } + } + } + }, + "Parameters": { + "BootstrapVersion": { + "Type": "AWS::SSM::Parameter::Value", + "Default": "/cdk-bootstrap/hnb659fds/version", + "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store." + } + }, + "Rules": { + "CheckBootstrapVersion": { + "Assertions": [ + { + "Assert": { + "Fn::Not": [ + { + "Fn::Contains": [ + [ + "1", + "2", + "3", + "4", + "5" + ], + { + "Ref": "BootstrapVersion" + } + ] + } + ] + }, + "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." + } + ] + } + } +} \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.ts new file mode 100644 index 000000000..9dc2598ab --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.ts @@ -0,0 +1,52 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +// Imports +import { App, Stack, Aws } from "@aws-cdk/core"; +import * as defaults from '@aws-solutions-constructs/core'; +import { PrivateHostedZone } from "@aws-cdk/aws-route53"; +import { Route53ToAlb, Route53ToAlbProps } from "../lib"; +import { generateIntegStackName } from '@aws-solutions-constructs/core'; + +// Setup +const app = new App(); +const stack = new Stack(app, generateIntegStackName(__filename), { + env: { account: Aws.ACCOUNT_ID, region: 'us-east-1' }, +}); +stack.templateOptions.description = 'Integration Test for aws-route53-alb'; + +const newVpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + constructVpcProps: { + enableDnsHostnames: true, + enableDnsSupport: true, + cidr: '172.168.0.0/16', + }, +}); + +const newZone = new PrivateHostedZone(stack, 'new-zone', { + zoneName: 'www.test-example.com', + vpc: newVpc, +}); + +// Definitions +const props: Route53ToAlbProps = { + publicApi: false, + existingHostedZoneInterface: newZone, + existingVpc: newVpc, +}; + +new Route53ToAlb(stack, 'test-route53-alb', props); + +// Synth +app.synth(); \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.expected.json new file mode 100644 index 000000000..930c86d4d --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.expected.json @@ -0,0 +1,779 @@ +{ + "Description": "Integration Test for aws-route53-alb", + "Resources": { + "Vpc8378EB38": { + "Type": "AWS::EC2::VPC", + "Properties": { + "CidrBlock": "172.168.0.0/16", + "EnableDnsHostnames": true, + "EnableDnsSupport": true, + "InstanceTenancy": "default", + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc" + } + ] + } + }, + "VpcPublicSubnet1Subnet5C2D37C4": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.0.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1a", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet1" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet1RouteTable6C95E38E": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet1RouteTableAssociation97140677": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet1RouteTable6C95E38E" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet1Subnet5C2D37C4" + } + } + }, + "VpcPublicSubnet1DefaultRoute3DA9E72A": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet1RouteTable6C95E38E" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet1EIPD7E02669": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet1NATGateway4D7517AA": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet1Subnet5C2D37C4" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet1EIPD7E02669", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet2Subnet691E08A3": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.32.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1b", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet2" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet2RouteTable94F7E489": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet2RouteTableAssociationDD5762D8": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet2RouteTable94F7E489" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet2Subnet691E08A3" + } + } + }, + "VpcPublicSubnet2DefaultRoute97F91067": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet2RouteTable94F7E489" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet2EIP3C605A87": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet2NATGateway9182C01D": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet2Subnet691E08A3" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet2EIP3C605A87", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet3SubnetBE12F0B6": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.64.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1c", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet3" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet3RouteTable93458DBB": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPublicSubnet3RouteTableAssociation1F1EDF02": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet3RouteTable93458DBB" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet3SubnetBE12F0B6" + } + } + }, + "VpcPublicSubnet3DefaultRoute4697774F": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet3RouteTable93458DBB" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet3EIP3A666A23": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPublicSubnet3NATGateway7640CD1D": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet3SubnetBE12F0B6" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet3EIP3A666A23", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPrivateSubnet1Subnet536B997A": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.96.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1a", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PrivateSubnet1" + } + ] + } + }, + "VpcPrivateSubnet1RouteTableB2C5B500": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PrivateSubnet1" + } + ] + } + }, + "VpcPrivateSubnet1RouteTableAssociation70C59FA6": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet1RouteTableB2C5B500" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet1Subnet536B997A" + } + } + }, + "VpcPrivateSubnet1DefaultRouteBE02A9ED": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet1RouteTableB2C5B500" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet1NATGateway4D7517AA" + } + } + }, + "VpcPrivateSubnet2Subnet3788AAA1": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.128.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1b", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PrivateSubnet2" + } + ] + } + }, + "VpcPrivateSubnet2RouteTableA678073B": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PrivateSubnet2" + } + ] + } + }, + "VpcPrivateSubnet2RouteTableAssociationA89CAD56": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet2RouteTableA678073B" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet2Subnet3788AAA1" + } + } + }, + "VpcPrivateSubnet2DefaultRoute060D2087": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet2RouteTableA678073B" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet2NATGateway9182C01D" + } + } + }, + "VpcPrivateSubnet3SubnetF258B56E": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.160.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1c", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PrivateSubnet3" + } + ] + } + }, + "VpcPrivateSubnet3RouteTableD98824C7": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc/PrivateSubnet3" + } + ] + } + }, + "VpcPrivateSubnet3RouteTableAssociation16BDDC43": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet3RouteTableD98824C7" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet3SubnetF258B56E" + } + } + }, + "VpcPrivateSubnet3DefaultRoute94B74F0D": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet3RouteTableD98824C7" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet3NATGateway7640CD1D" + } + } + }, + "VpcIGWD7BA715C": { + "Type": "AWS::EC2::InternetGateway", + "Properties": { + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc" + } + ] + } + }, + "VpcVPCGWBF912B6E": { + "Type": "AWS::EC2::VPCGatewayAttachment", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "InternetGatewayId": { + "Ref": "VpcIGWD7BA715C" + } + } + }, + "VpcFlowLogIAMRole6A475D41": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "vpc-flow-logs.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc" + } + ] + } + }, + "VpcFlowLogIAMRoleDefaultPolicy406FB995": { + "Type": "AWS::IAM::Policy", + "Properties": { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "logs:CreateLogStream", + "logs:PutLogEvents", + "logs:DescribeLogStreams" + ], + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogLogGroup7B5C56B9", + "Arn" + ] + } + }, + { + "Action": "iam:PassRole", + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + } + } + ], + "Version": "2012-10-17" + }, + "PolicyName": "VpcFlowLogIAMRoleDefaultPolicy406FB995", + "Roles": [ + { + "Ref": "VpcFlowLogIAMRole6A475D41" + } + ] + } + }, + "VpcFlowLogLogGroup7B5C56B9": { + "Type": "AWS::Logs::LogGroup", + "Properties": { + "RetentionInDays": 731 + }, + "UpdateReplacePolicy": "Retain", + "DeletionPolicy": "Retain", + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W84", + "reason": "By default CloudWatchLogs LogGroups data is encrypted using the CloudWatch server-side encryption keys (AWS Managed Keys)" + } + ] + } + } + }, + "VpcFlowLog8FF33A73": { + "Type": "AWS::EC2::FlowLog", + "Properties": { + "ResourceId": { + "Ref": "Vpc8378EB38" + }, + "ResourceType": "VPC", + "TrafficType": "ALL", + "DeliverLogsPermissionArn": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + }, + "LogDestinationType": "cloud-watch-logs", + "LogGroupName": { + "Ref": "VpcFlowLogLogGroup7B5C56B9" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiExistingAlb/Vpc" + } + ] + } + }, + "newzone1D011936": { + "Type": "AWS::Route53::HostedZone", + "Properties": { + "Name": "www.test-example.com." + } + }, + "testalb9AFCD824": { + "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", + "Properties": { + "LoadBalancerAttributes": [ + { + "Key": "deletion_protection.enabled", + "Value": "false" + } + ], + "Name": "find-this-name", + "Scheme": "internal", + "SecurityGroups": [ + { + "Fn::GetAtt": [ + "testalbSecurityGroup0C84CDF9", + "GroupId" + ] + } + ], + "Subnets": [ + { + "Ref": "VpcPrivateSubnet1Subnet536B997A" + }, + { + "Ref": "VpcPrivateSubnet2Subnet3788AAA1" + }, + { + "Ref": "VpcPrivateSubnet3SubnetF258B56E" + } + ], + "Type": "application" + } + }, + "testalbSecurityGroup0C84CDF9": { + "Type": "AWS::EC2::SecurityGroup", + "Properties": { + "GroupDescription": "Automatically created Security Group for ELB deployPublicApiExistingAlbtestalb700DF81E", + "SecurityGroupEgress": [ + { + "CidrIp": "255.255.255.255/32", + "Description": "Disallow all traffic", + "FromPort": 252, + "IpProtocol": "icmp", + "ToPort": 86 + } + ], + "VpcId": { + "Ref": "Vpc8378EB38" + } + } + }, + "testroute53albtestroute53albaliasCCC6DDF3": { + "Type": "AWS::Route53::RecordSet", + "Properties": { + "Name": "www.test-example.com.", + "Type": "A", + "AliasTarget": { + "DNSName": { + "Fn::Join": [ + "", + [ + "dualstack.", + { + "Fn::GetAtt": [ + "testalb9AFCD824", + "DNSName" + ] + } + ] + ] + }, + "HostedZoneId": { + "Fn::GetAtt": [ + "testalb9AFCD824", + "CanonicalHostedZoneID" + ] + } + }, + "HostedZoneId": { + "Ref": "newzone1D011936" + } + } + } + }, + "Parameters": { + "BootstrapVersion": { + "Type": "AWS::SSM::Parameter::Value", + "Default": "/cdk-bootstrap/hnb659fds/version", + "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store." + } + }, + "Rules": { + "CheckBootstrapVersion": { + "Assertions": [ + { + "Assert": { + "Fn::Not": [ + { + "Fn::Contains": [ + [ + "1", + "2", + "3", + "4", + "5" + ], + { + "Ref": "BootstrapVersion" + } + ] + } + ] + }, + "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." + } + ] + } + } +} \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.ts new file mode 100644 index 000000000..55a13d732 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.ts @@ -0,0 +1,58 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +// Imports +import { App, Stack, Aws } from "@aws-cdk/core"; +import * as defaults from '@aws-solutions-constructs/core'; +import { ApplicationLoadBalancer } from "@aws-cdk/aws-elasticloadbalancingv2"; +import { PublicHostedZone } from "@aws-cdk/aws-route53"; +import { Route53ToAlb, Route53ToAlbProps } from "../lib"; +import { generateIntegStackName } from '@aws-solutions-constructs/core'; + +// Setup +const app = new App(); +const stack = new Stack(app, generateIntegStackName(__filename), { + env: { account: Aws.ACCOUNT_ID, region: 'us-east-1' }, +}); +stack.templateOptions.description = 'Integration Test for aws-route53-alb'; + +const newVpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + constructVpcProps: { + enableDnsHostnames: true, + enableDnsSupport: true, + cidr: '172.168.0.0/16', + }, +}); + +const newZone = new PublicHostedZone(stack, 'new-zone', { + zoneName: 'www.test-example.com', +}); + +const existingAlb = new ApplicationLoadBalancer(stack, 'test-alb', { + vpc: newVpc, + loadBalancerName: 'find-this-name' +}); + +// Definitions +const props: Route53ToAlbProps = { + publicApi: true, + existingHostedZoneInterface: newZone, + existingVpc: newVpc, + existingLoadBalancerObj: existingAlb, +}; + +new Route53ToAlb(stack, 'test-route53-alb', props); + +// Synth +app.synth(); \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json new file mode 100644 index 000000000..a428bb0f6 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json @@ -0,0 +1,926 @@ +{ + "Description": "Integration Test for aws-route53-alb", + "Resources": { + "Vpc8378EB38": { + "Type": "AWS::EC2::VPC", + "Properties": { + "CidrBlock": "172.168.0.0/16", + "EnableDnsHostnames": true, + "EnableDnsSupport": true, + "InstanceTenancy": "default", + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc" + } + ] + } + }, + "VpcPublicSubnet1Subnet5C2D37C4": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.0.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1a", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet1" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet1RouteTable6C95E38E": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet1RouteTableAssociation97140677": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet1RouteTable6C95E38E" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet1Subnet5C2D37C4" + } + } + }, + "VpcPublicSubnet1DefaultRoute3DA9E72A": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet1RouteTable6C95E38E" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet1EIPD7E02669": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet1NATGateway4D7517AA": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet1Subnet5C2D37C4" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet1EIPD7E02669", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet1" + } + ] + } + }, + "VpcPublicSubnet2Subnet691E08A3": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.32.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1b", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet2" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet2RouteTable94F7E489": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet2RouteTableAssociationDD5762D8": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet2RouteTable94F7E489" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet2Subnet691E08A3" + } + } + }, + "VpcPublicSubnet2DefaultRoute97F91067": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet2RouteTable94F7E489" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet2EIP3C605A87": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet2NATGateway9182C01D": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet2Subnet691E08A3" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet2EIP3C605A87", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet2" + } + ] + } + }, + "VpcPublicSubnet3SubnetBE12F0B6": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.64.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1c", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet3" + } + ] + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W33", + "reason": "Allow Public Subnets to have MapPublicIpOnLaunch set to true" + } + ] + } + } + }, + "VpcPublicSubnet3RouteTable93458DBB": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPublicSubnet3RouteTableAssociation1F1EDF02": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet3RouteTable93458DBB" + }, + "SubnetId": { + "Ref": "VpcPublicSubnet3SubnetBE12F0B6" + } + } + }, + "VpcPublicSubnet3DefaultRoute4697774F": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPublicSubnet3RouteTable93458DBB" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "VpcIGWD7BA715C" + } + }, + "DependsOn": [ + "VpcVPCGWBF912B6E" + ] + }, + "VpcPublicSubnet3EIP3A666A23": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPublicSubnet3NATGateway7640CD1D": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "VpcPublicSubnet3SubnetBE12F0B6" + }, + "AllocationId": { + "Fn::GetAtt": [ + "VpcPublicSubnet3EIP3A666A23", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PublicSubnet3" + } + ] + } + }, + "VpcPrivateSubnet1Subnet536B997A": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.96.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1a", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PrivateSubnet1" + } + ] + } + }, + "VpcPrivateSubnet1RouteTableB2C5B500": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PrivateSubnet1" + } + ] + } + }, + "VpcPrivateSubnet1RouteTableAssociation70C59FA6": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet1RouteTableB2C5B500" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet1Subnet536B997A" + } + } + }, + "VpcPrivateSubnet1DefaultRouteBE02A9ED": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet1RouteTableB2C5B500" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet1NATGateway4D7517AA" + } + } + }, + "VpcPrivateSubnet2Subnet3788AAA1": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.128.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1b", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PrivateSubnet2" + } + ] + } + }, + "VpcPrivateSubnet2RouteTableA678073B": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PrivateSubnet2" + } + ] + } + }, + "VpcPrivateSubnet2RouteTableAssociationA89CAD56": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet2RouteTableA678073B" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet2Subnet3788AAA1" + } + } + }, + "VpcPrivateSubnet2DefaultRoute060D2087": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet2RouteTableA678073B" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet2NATGateway9182C01D" + } + } + }, + "VpcPrivateSubnet3SubnetF258B56E": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "172.168.160.0/19", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1c", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PrivateSubnet3" + } + ] + } + }, + "VpcPrivateSubnet3RouteTableD98824C7": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc/PrivateSubnet3" + } + ] + } + }, + "VpcPrivateSubnet3RouteTableAssociation16BDDC43": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet3RouteTableD98824C7" + }, + "SubnetId": { + "Ref": "VpcPrivateSubnet3SubnetF258B56E" + } + } + }, + "VpcPrivateSubnet3DefaultRoute94B74F0D": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "VpcPrivateSubnet3RouteTableD98824C7" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "VpcPublicSubnet3NATGateway7640CD1D" + } + } + }, + "VpcIGWD7BA715C": { + "Type": "AWS::EC2::InternetGateway", + "Properties": { + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc" + } + ] + } + }, + "VpcVPCGWBF912B6E": { + "Type": "AWS::EC2::VPCGatewayAttachment", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "InternetGatewayId": { + "Ref": "VpcIGWD7BA715C" + } + } + }, + "VpcFlowLogIAMRole6A475D41": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "vpc-flow-logs.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc" + } + ] + } + }, + "VpcFlowLogIAMRoleDefaultPolicy406FB995": { + "Type": "AWS::IAM::Policy", + "Properties": { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "logs:CreateLogStream", + "logs:PutLogEvents", + "logs:DescribeLogStreams" + ], + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogLogGroup7B5C56B9", + "Arn" + ] + } + }, + { + "Action": "iam:PassRole", + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + } + } + ], + "Version": "2012-10-17" + }, + "PolicyName": "VpcFlowLogIAMRoleDefaultPolicy406FB995", + "Roles": [ + { + "Ref": "VpcFlowLogIAMRole6A475D41" + } + ] + } + }, + "VpcFlowLogLogGroup7B5C56B9": { + "Type": "AWS::Logs::LogGroup", + "Properties": { + "RetentionInDays": 731 + }, + "UpdateReplacePolicy": "Retain", + "DeletionPolicy": "Retain", + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W84", + "reason": "By default CloudWatchLogs LogGroups data is encrypted using the CloudWatch server-side encryption keys (AWS Managed Keys)" + } + ] + } + } + }, + "VpcFlowLog8FF33A73": { + "Type": "AWS::EC2::FlowLog", + "Properties": { + "ResourceId": { + "Ref": "Vpc8378EB38" + }, + "ResourceType": "VPC", + "TrafficType": "ALL", + "DeliverLogsPermissionArn": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + }, + "LogDestinationType": "cloud-watch-logs", + "LogGroupName": { + "Ref": "VpcFlowLogLogGroup7B5C56B9" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployPublicApiNewAlb/Vpc" + } + ] + } + }, + "newzone1D011936": { + "Type": "AWS::Route53::HostedZone", + "Properties": { + "Name": "www.test-example.com." + } + }, + "testroute53albtestroute53albalb7C171F50": { + "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", + "Properties": { + "LoadBalancerAttributes": [ + { + "Key": "deletion_protection.enabled", + "Value": "false" + }, + { + "Key": "access_logs.s3.enabled", + "Value": "true" + }, + { + "Key": "access_logs.s3.bucket", + "Value": { + "Ref": "testroute53albAC463A50" + } + }, + { + "Key": "access_logs.s3.prefix", + "Value": "" + } + ], + "Name": "new-alb", + "Scheme": "internet-facing", + "SecurityGroups": [ + { + "Fn::GetAtt": [ + "testroute53albtestroute53albalbSecurityGroupC3716E02", + "GroupId" + ] + } + ], + "Subnets": [ + { + "Ref": "VpcPublicSubnet1Subnet5C2D37C4" + }, + { + "Ref": "VpcPublicSubnet2Subnet691E08A3" + }, + { + "Ref": "VpcPublicSubnet3SubnetBE12F0B6" + } + ], + "Type": "application" + }, + "DependsOn": [ + "testroute53albPolicy478FC0AF", + "testroute53albAC463A50", + "VpcPublicSubnet1DefaultRoute3DA9E72A", + "VpcPublicSubnet2DefaultRoute97F91067", + "VpcPublicSubnet3DefaultRoute4697774F" + ] + }, + "testroute53albtestroute53albalbSecurityGroupC3716E02": { + "Type": "AWS::EC2::SecurityGroup", + "Properties": { + "GroupDescription": "Automatically created Security Group for ELB deployPublicApiNewAlbtestroute53albtestroute53albalbC4C12C26", + "SecurityGroupEgress": [ + { + "CidrIp": "255.255.255.255/32", + "Description": "Disallow all traffic", + "FromPort": 252, + "IpProtocol": "icmp", + "ToPort": 86 + } + ], + "VpcId": { + "Ref": "Vpc8378EB38" + } + }, + "DependsOn": [ + "testroute53albPolicy478FC0AF", + "testroute53albAC463A50" + ] + }, + "testroute53albAC463A50": { + "Type": "AWS::S3::Bucket", + "Properties": { + "BucketEncryption": { + "ServerSideEncryptionConfiguration": [ + { + "ServerSideEncryptionByDefault": { + "SSEAlgorithm": "AES256" + } + } + ] + }, + "PublicAccessBlockConfiguration": { + "BlockPublicAcls": true, + "BlockPublicPolicy": true, + "IgnorePublicAcls": true, + "RestrictPublicBuckets": true + }, + "VersioningConfiguration": { + "Status": "Enabled" + } + }, + "UpdateReplacePolicy": "Retain", + "DeletionPolicy": "Retain", + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W35", + "reason": "This is a log bucket for an Application Load Balancer" + } + ] + } + } + }, + "testroute53albPolicy478FC0AF": { + "Type": "AWS::S3::BucketPolicy", + "Properties": { + "Bucket": { + "Ref": "testroute53albAC463A50" + }, + "PolicyDocument": { + "Statement": [ + { + "Action": "*", + "Condition": { + "Bool": { + "aws:SecureTransport": "false" + } + }, + "Effect": "Deny", + "Principal": { + "AWS": "*" + }, + "Resource": [ + { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "testroute53albAC463A50", + "Arn" + ] + }, + "/*" + ] + ] + }, + { + "Fn::GetAtt": [ + "testroute53albAC463A50", + "Arn" + ] + } + ], + "Sid": "HttpsOnly" + }, + { + "Action": [ + "s3:PutObject", + "s3:Abort*" + ], + "Effect": "Allow", + "Principal": { + "AWS": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::127311923021:root" + ] + ] + } + }, + "Resource": { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "testroute53albAC463A50", + "Arn" + ] + }, + "/AWSLogs/", + { + "Ref": "AWS::AccountId" + }, + "/*" + ] + ] + } + } + ], + "Version": "2012-10-17" + } + } + }, + "testroute53albtestroute53albaliasCCC6DDF3": { + "Type": "AWS::Route53::RecordSet", + "Properties": { + "Name": "www.test-example.com.", + "Type": "A", + "AliasTarget": { + "DNSName": { + "Fn::Join": [ + "", + [ + "dualstack.", + { + "Fn::GetAtt": [ + "testroute53albtestroute53albalb7C171F50", + "DNSName" + ] + } + ] + ] + }, + "HostedZoneId": { + "Fn::GetAtt": [ + "testroute53albtestroute53albalb7C171F50", + "CanonicalHostedZoneID" + ] + } + }, + "HostedZoneId": { + "Ref": "newzone1D011936" + } + } + } + }, + "Parameters": { + "BootstrapVersion": { + "Type": "AWS::SSM::Parameter::Value", + "Default": "/cdk-bootstrap/hnb659fds/version", + "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store." + } + }, + "Rules": { + "CheckBootstrapVersion": { + "Assertions": [ + { + "Assert": { + "Fn::Not": [ + { + "Fn::Contains": [ + [ + "1", + "2", + "3", + "4", + "5" + ], + { + "Ref": "BootstrapVersion" + } + ] + } + ] + }, + "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." + } + ] + } + } +} \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts new file mode 100644 index 000000000..9a51b32ba --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts @@ -0,0 +1,54 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +// Imports +import { App, Stack, Aws } from "@aws-cdk/core"; +import * as defaults from '@aws-solutions-constructs/core'; +import { PublicHostedZone } from "@aws-cdk/aws-route53"; +import { Route53ToAlb, Route53ToAlbProps } from "../lib"; +import { generateIntegStackName } from '@aws-solutions-constructs/core'; + +// Setup +const app = new App(); +const stack = new Stack(app, generateIntegStackName(__filename), { + env: { account: Aws.ACCOUNT_ID, region: 'us-east-1' }, +}); +stack.templateOptions.description = 'Integration Test for aws-route53-alb'; + +const newVpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + constructVpcProps: { + enableDnsHostnames: true, + enableDnsSupport: true, + cidr: '172.168.0.0/16', + }, +}); + +const newZone = new PublicHostedZone(stack, 'new-zone', { + zoneName: 'www.test-example.com', +}); + +// Definitions +const props: Route53ToAlbProps = { + publicApi: true, + existingHostedZoneInterface: newZone, + existingVpc: newVpc, + loadBalancerProps: { + loadBalancerName: 'new-alb', + } +}; + +new Route53ToAlb(stack, 'test-route53-alb', props); + +// Synth +app.synth(); \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.expected.json new file mode 100644 index 000000000..b94a3d612 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.expected.json @@ -0,0 +1,407 @@ +{ + "Description": "Integration Test for aws-route53-alb", + "Resources": { + "testroute53albtestroute53albzone04BEDFE6": { + "Type": "AWS::Route53::HostedZone", + "Properties": { + "Name": "www.example.com.", + "VPCs": [ + { + "VPCId": { + "Ref": "Vpc8378EB38" + }, + "VPCRegion": "us-east-1" + } + ] + } + }, + "testroute53albtestroute53albalb7C171F50": { + "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", + "Properties": { + "LoadBalancerAttributes": [ + { + "Key": "deletion_protection.enabled", + "Value": "false" + } + ], + "Scheme": "internal", + "SecurityGroups": [ + { + "Fn::GetAtt": [ + "testroute53albtestroute53albalbSecurityGroupC3716E02", + "GroupId" + ] + } + ], + "Subnets": [ + { + "Ref": "VpcisolatedSubnet1SubnetE62B1B9B" + }, + { + "Ref": "VpcisolatedSubnet2Subnet39217055" + }, + { + "Ref": "VpcisolatedSubnet3Subnet44F2537D" + } + ], + "Type": "application" + } + }, + "testroute53albtestroute53albalbSecurityGroupC3716E02": { + "Type": "AWS::EC2::SecurityGroup", + "Properties": { + "GroupDescription": "Automatically created Security Group for ELB deployWithoutLoggingtestroute53albtestroute53albalbF6630861", + "SecurityGroupEgress": [ + { + "CidrIp": "255.255.255.255/32", + "Description": "Disallow all traffic", + "FromPort": 252, + "IpProtocol": "icmp", + "ToPort": 86 + } + ], + "VpcId": { + "Ref": "Vpc8378EB38" + } + } + }, + "testroute53albtestroute53albaliasCCC6DDF3": { + "Type": "AWS::Route53::RecordSet", + "Properties": { + "Name": "www.example.com.", + "Type": "A", + "AliasTarget": { + "DNSName": { + "Fn::Join": [ + "", + [ + "dualstack.", + { + "Fn::GetAtt": [ + "testroute53albtestroute53albalb7C171F50", + "DNSName" + ] + } + ] + ] + }, + "HostedZoneId": { + "Fn::GetAtt": [ + "testroute53albtestroute53albalb7C171F50", + "CanonicalHostedZoneID" + ] + } + }, + "HostedZoneId": { + "Ref": "testroute53albtestroute53albzone04BEDFE6" + } + } + }, + "Vpc8378EB38": { + "Type": "AWS::EC2::VPC", + "Properties": { + "CidrBlock": "10.0.0.0/16", + "EnableDnsHostnames": true, + "EnableDnsSupport": true, + "InstanceTenancy": "default", + "Tags": [ + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc" + } + ] + } + }, + "VpcisolatedSubnet1SubnetE62B1B9B": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "10.0.0.0/18", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1a", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "isolated" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Isolated" + }, + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc/isolatedSubnet1" + } + ] + } + }, + "VpcisolatedSubnet1RouteTableE442650B": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc/isolatedSubnet1" + } + ] + } + }, + "VpcisolatedSubnet1RouteTableAssociationD259E31A": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcisolatedSubnet1RouteTableE442650B" + }, + "SubnetId": { + "Ref": "VpcisolatedSubnet1SubnetE62B1B9B" + } + } + }, + "VpcisolatedSubnet2Subnet39217055": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "10.0.64.0/18", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1b", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "isolated" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Isolated" + }, + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc/isolatedSubnet2" + } + ] + } + }, + "VpcisolatedSubnet2RouteTable334F9764": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc/isolatedSubnet2" + } + ] + } + }, + "VpcisolatedSubnet2RouteTableAssociation25A4716F": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcisolatedSubnet2RouteTable334F9764" + }, + "SubnetId": { + "Ref": "VpcisolatedSubnet2Subnet39217055" + } + } + }, + "VpcisolatedSubnet3Subnet44F2537D": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "CidrBlock": "10.0.128.0/18", + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "AvailabilityZone": "test-region-1c", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "isolated" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Isolated" + }, + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc/isolatedSubnet3" + } + ] + } + }, + "VpcisolatedSubnet3RouteTableA2F6BBC0": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "Vpc8378EB38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc/isolatedSubnet3" + } + ] + } + }, + "VpcisolatedSubnet3RouteTableAssociationDC010BEB": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "VpcisolatedSubnet3RouteTableA2F6BBC0" + }, + "SubnetId": { + "Ref": "VpcisolatedSubnet3Subnet44F2537D" + } + } + }, + "VpcFlowLogIAMRole6A475D41": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "vpc-flow-logs.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc" + } + ] + } + }, + "VpcFlowLogIAMRoleDefaultPolicy406FB995": { + "Type": "AWS::IAM::Policy", + "Properties": { + "PolicyDocument": { + "Statement": [ + { + "Action": [ + "logs:CreateLogStream", + "logs:PutLogEvents", + "logs:DescribeLogStreams" + ], + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogLogGroup7B5C56B9", + "Arn" + ] + } + }, + { + "Action": "iam:PassRole", + "Effect": "Allow", + "Resource": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + } + } + ], + "Version": "2012-10-17" + }, + "PolicyName": "VpcFlowLogIAMRoleDefaultPolicy406FB995", + "Roles": [ + { + "Ref": "VpcFlowLogIAMRole6A475D41" + } + ] + } + }, + "VpcFlowLogLogGroup7B5C56B9": { + "Type": "AWS::Logs::LogGroup", + "Properties": { + "RetentionInDays": 731 + }, + "UpdateReplacePolicy": "Retain", + "DeletionPolicy": "Retain", + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W84", + "reason": "By default CloudWatchLogs LogGroups data is encrypted using the CloudWatch server-side encryption keys (AWS Managed Keys)" + } + ] + } + } + }, + "VpcFlowLog8FF33A73": { + "Type": "AWS::EC2::FlowLog", + "Properties": { + "ResourceId": { + "Ref": "Vpc8378EB38" + }, + "ResourceType": "VPC", + "TrafficType": "ALL", + "DeliverLogsPermissionArn": { + "Fn::GetAtt": [ + "VpcFlowLogIAMRole6A475D41", + "Arn" + ] + }, + "LogDestinationType": "cloud-watch-logs", + "LogGroupName": { + "Ref": "VpcFlowLogLogGroup7B5C56B9" + }, + "Tags": [ + { + "Key": "Name", + "Value": "deployWithoutLogging/Vpc" + } + ] + } + } + }, + "Parameters": { + "BootstrapVersion": { + "Type": "AWS::SSM::Parameter::Value", + "Default": "/cdk-bootstrap/hnb659fds/version", + "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store." + } + }, + "Rules": { + "CheckBootstrapVersion": { + "Assertions": [ + { + "Assert": { + "Fn::Not": [ + { + "Fn::Contains": [ + [ + "1", + "2", + "3", + "4", + "5" + ], + { + "Ref": "BootstrapVersion" + } + ] + } + ] + }, + "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." + } + ] + } + } +} \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.ts new file mode 100644 index 000000000..8afda2608 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.ts @@ -0,0 +1,38 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +// Imports +import { App, Stack, Aws } from "@aws-cdk/core"; +import { Route53ToAlb, Route53ToAlbProps } from "../lib"; +import { generateIntegStackName } from '@aws-solutions-constructs/core'; + +// Setup +const app = new App(); +const stack = new Stack(app, generateIntegStackName(__filename), { + env: { account: Aws.ACCOUNT_ID, region: 'us-east-1' }, +}); +stack.templateOptions.description = 'Integration Test for aws-route53-alb'; + +// Definitions +const props: Route53ToAlbProps = { + publicApi: false, + privateHostedZoneProps: { + zoneName: 'www.example.com' + }, + logAccessLogs: false, +}; + +new Route53ToAlb(stack, 'test-route53-alb', props); + +// Synth +app.synth(); \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/route53-alb.test.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/route53-alb.test.ts new file mode 100644 index 000000000..e3fb1596b --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/route53-alb.test.ts @@ -0,0 +1,384 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +// Imports +import { Stack } from "@aws-cdk/core"; +import { Route53ToAlb, Route53ToAlbProps } from '../lib'; +import * as r53 from '@aws-cdk/aws-route53'; +import * as elb from '@aws-cdk/aws-elasticloadbalancingv2'; +import '@aws-cdk/assert/jest'; +import * as defaults from '@aws-solutions-constructs/core'; + +// Helper Functions + +function getTestVpc(stack: Stack) { + return defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + constructVpcProps: { + enableDnsHostnames: true, + enableDnsSupport: true, + cidr: '172.168.0.0/16', + }, + }); +} + +test('Test Public API, new VPC', () => { + // Initial Setup + const stack = new Stack(undefined, undefined, { + env: { account: "123456789012", region: 'us-east-1' }, + }); + + const newZone = new r53.PublicHostedZone(stack, 'test-zone', { + zoneName: 'www.example-test.com' + }); + + const props: Route53ToAlbProps = { + publicApi: true, + existingHostedZoneInterface: newZone, + }; + + new Route53ToAlb(stack, 'test-route53-alb', props); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Scheme: 'internet-facing' + }); + + expect(stack).toHaveResourceLike('AWS::EC2::VPC', { + EnableDnsHostnames: true, + EnableDnsSupport: true, + InstanceTenancy: "default", + }); + + expect(stack).toHaveResourceLike('AWS::Route53::RecordSet', { + Name: 'www.example-test.com.', + Type: 'A' + }); + +}); + +test('Test Private API, existing VPC', () => { + // Initial Setup + const stack = new Stack(undefined, undefined, { + env: { account: "123456789012", region: 'us-east-1' }, + }); + + const testExistingVpc = getTestVpc(stack); + + const newZone = new r53.PrivateHostedZone(stack, 'test-zone', { + zoneName: 'www.example-test.com', + vpc: testExistingVpc + }); + + const props: Route53ToAlbProps = { + publicApi: false, + existingHostedZoneInterface: newZone, + existingVpc: testExistingVpc + }; + + new Route53ToAlb(stack, 'test-route53-alb', props); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Scheme: 'internal' + }); + + expect(stack).toHaveResourceLike('AWS::EC2::VPC', { + EnableDnsHostnames: true, + EnableDnsSupport: true, + InstanceTenancy: "default", + }); + + expect(stack).toHaveResourceLike('AWS::Route53::RecordSet', { + Name: 'www.example-test.com.', + Type: 'A' + }); + +}); + +test('Check publicApi and zone props is an error', () => { + // Initial Setup + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const props: Route53ToAlbProps = { + publicApi: true, + existingVpc: testExistingVpc, + privateHostedZoneProps: { + zoneName: 'www.example-test.com', + } + }; + + const app = () => { + new Route53ToAlb(stack, 'test-error', props); + }; + // Assertion + expect(app).toThrowError(); +}); + +test('Check no Zone props and no existing zone interface is an error', () => { + // Initial Setup + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const props: Route53ToAlbProps = { + publicApi: false, + existingVpc: testExistingVpc, + }; + + const app = () => { + new Route53ToAlb(stack, 'test-error', props); + }; + // Assertion + expect(app).toThrowError(); +}); + +test('Check Zone props with VPC is an error', () => { + // Initial Setup + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const props: Route53ToAlbProps = { + publicApi: false, + existingVpc: testExistingVpc, + privateHostedZoneProps: { + zoneName: 'www.example-test.com', + vpc: testExistingVpc + } + }; + + const app = () => { + new Route53ToAlb(stack, 'test-error', props); + }; + // Assertion + expect(app).toThrowError(); + +}); + +test('Test with privateHostedZoneProps', () => { + // Initial Setup + const stack = new Stack(undefined, undefined, { + env: { account: "123456789012", region: 'us-east-1' }, + }); + + const testExistingVpc = getTestVpc(stack); + + const props: Route53ToAlbProps = { + publicApi: false, + existingVpc: testExistingVpc, + privateHostedZoneProps: { + zoneName: 'www.example-test.com', + } + }; + + new Route53ToAlb(stack, 'test-error', props); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Scheme: 'internal' + }); + + expect(stack).toHaveResourceLike('AWS::EC2::VPC', { + EnableDnsHostnames: true, + EnableDnsSupport: true, + InstanceTenancy: "default", + }); + + expect(stack).toHaveResourceLike('AWS::Route53::RecordSet', { + Name: 'www.example-test.com.', + Type: 'A' + }); +}); + +test('Check that passing an existing hosted Zone without passing an existingVPC is an error', () => { + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const newZone = new r53.PrivateHostedZone(stack, 'test-zone', { + zoneName: 'www.example-test.com', + vpc: testExistingVpc + }); + + const props: Route53ToAlbProps = { + publicApi: false, + existingHostedZoneInterface: newZone, + }; + + const app = () => { + new Route53ToAlb(stack, 'test-error', props); + }; + // Assertion + expect(app).toThrowError(); + +}); + +test('Check that passing an existing Load Balancer without passing an existingVPC is an error', () => { + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const existingAlb = new elb.ApplicationLoadBalancer(stack, 'test-alb', { + vpc: testExistingVpc + }); + + const props: Route53ToAlbProps = { + publicApi: false, + existingLoadBalancerObj: existingAlb, + privateHostedZoneProps: { + zoneName: 'www.example-test.com', + } + }; + + const app = () => { + new Route53ToAlb(stack, 'test-error', props); + }; + // Assertion + expect(app).toThrowError(); + +}); + +test('Check that passing an existing ALB without passing an existingVPC is an error', () => { + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const newZone = new r53.PrivateHostedZone(stack, 'test-zone', { + zoneName: 'www.example-test.com', + vpc: testExistingVpc + }); + + const props: Route53ToAlbProps = { + publicApi: false, + existingHostedZoneInterface: newZone, + }; + + const app = () => { + new Route53ToAlb(stack, 'test-error', props); + }; + // Assertion + expect(app).toThrowError(); + +}); + +test('Check that passing loadBalancerProps with a vpc is an error', () => { + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const newZone = new r53.PrivateHostedZone(stack, 'test-zone', { + zoneName: 'www.example-test.com', + vpc: testExistingVpc + }); + + const props: Route53ToAlbProps = { + publicApi: false, + existingHostedZoneInterface: newZone, + loadBalancerProps: { + loadBalancerName: 'my-alb', + vpc: testExistingVpc, + } + }; + + const app = () => { + new Route53ToAlb(stack, 'test-error', props); + }; + // Assertion + expect(app).toThrowError(); + +}); + +test('Test providing loadBalancerProps', () => { + // Initial Setup + const stack = new Stack(undefined, undefined, { + env: { account: "123456789012", region: 'us-east-1' }, + }); + + const testExistingVpc = getTestVpc(stack); + + const newZone = new r53.PrivateHostedZone(stack, 'test-zone', { + zoneName: 'www.example-test.com', + vpc: testExistingVpc + }); + + const props: Route53ToAlbProps = { + publicApi: false, + existingHostedZoneInterface: newZone, + existingVpc: testExistingVpc, + loadBalancerProps: { + loadBalancerName: 'find-this-name' + }, + }; + + new Route53ToAlb(stack, 'test-route53-alb', props); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Scheme: 'internal', + Name: 'find-this-name' + }); + + expect(stack).toHaveResourceLike('AWS::EC2::VPC', { + EnableDnsHostnames: true, + EnableDnsSupport: true, + InstanceTenancy: "default", + }); + + expect(stack).toHaveResourceLike('AWS::Route53::RecordSet', { + Name: 'www.example-test.com.', + Type: 'A' + }); + +}); + +test('Test providing an existingLoadBalancer', () => { + // Initial Setup + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const newZone = new r53.PrivateHostedZone(stack, 'test-zone', { + zoneName: 'www.example-test.com', + vpc: testExistingVpc + }); + + const existingAlb = new elb.ApplicationLoadBalancer(stack, 'test-alb', { + vpc: testExistingVpc, + loadBalancerName: 'find-this-name' + }); + + const props: Route53ToAlbProps = { + publicApi: false, + existingHostedZoneInterface: newZone, + existingVpc: testExistingVpc, + existingLoadBalancerObj: existingAlb, + }; + + new Route53ToAlb(stack, 'test-route53-alb', props); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Scheme: 'internal', + Name: 'find-this-name' + }); + + expect(stack).toHaveResourceLike('AWS::EC2::VPC', { + EnableDnsHostnames: true, + EnableDnsSupport: true, + InstanceTenancy: "default", + }); + + expect(stack).toHaveResourceLike('AWS::Route53::RecordSet', { + Name: 'www.example-test.com.', + Type: 'A' + }); + +}); diff --git a/source/patterns/@aws-solutions-constructs/core/index.ts b/source/patterns/@aws-solutions-constructs/core/index.ts index 1a22a80fc..2d4b451df 100644 --- a/source/patterns/@aws-solutions-constructs/core/index.ts +++ b/source/patterns/@aws-solutions-constructs/core/index.ts @@ -11,6 +11,8 @@ * and limitations under the License. */ +export * from './lib/alb-defaults'; +export * from './lib/alb-helper'; export * from './lib/apigateway-defaults'; export * from './lib/apigateway-helper'; export * from './lib/dynamodb-table-defaults'; diff --git a/source/patterns/@aws-solutions-constructs/core/lib/alb-defaults.ts b/source/patterns/@aws-solutions-constructs/core/lib/alb-defaults.ts new file mode 100644 index 000000000..5659e534f --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/core/lib/alb-defaults.ts @@ -0,0 +1,21 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +import * as elb from "@aws-cdk/aws-elasticloadbalancingv2"; + +export function DefaultListenerProps(loadBalancer: elb.ApplicationLoadBalancer): elb.ApplicationListenerProps { + return { + loadBalancer, + protocol: elb.ApplicationProtocol.HTTPS, + }; +} \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/core/lib/alb-helper.ts b/source/patterns/@aws-solutions-constructs/core/lib/alb-helper.ts new file mode 100644 index 000000000..7ac21d40c --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/core/lib/alb-helper.ts @@ -0,0 +1,152 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +import * as elb from "@aws-cdk/aws-elasticloadbalancingv2"; +import { Construct } from "@aws-cdk/core"; +import * as ec2 from "@aws-cdk/aws-ec2"; +import * as s3 from "@aws-cdk/aws-s3"; +import * as lambda from "@aws-cdk/aws-lambda"; +import { ApplicationProtocol, ListenerAction, } from "@aws-cdk/aws-elasticloadbalancingv2"; +import * as elbt from "@aws-cdk/aws-elasticloadbalancingv2-targets"; +import { overrideProps, printWarning } from "./utils"; +import { DefaultListenerProps } from "./alb-defaults"; +import { createAlbLoggingBucket } from "./s3-bucket-helper"; +import { DefaultLoggingBucketProps } from "./s3-bucket-defaults"; + +// Returns the correct ALB Load Balancer to use in this construct, either an existing +// one provided as an argument or create new one otherwise. +export function ObtainAlb( + scope: Construct, + id: string, + vpc: ec2.IVpc, + publicApi: boolean, + existingLoadBalancerInterface?: elb.ApplicationLoadBalancer, + loadBalancerProps?: elb.ApplicationLoadBalancerProps | any, + logAccessLogs?: boolean, + loggingBucketProps?: s3.BucketProps +): elb.ApplicationLoadBalancer { + let loadBalancer: elb.ApplicationLoadBalancer; + + if (existingLoadBalancerInterface) { + loadBalancer = existingLoadBalancerInterface; + } else { + const consolidatedProps = loadBalancerProps + ? overrideProps(loadBalancerProps, { vpc, internetFacing: publicApi }) + : { vpc, internetFacing: publicApi }; + loadBalancer = new elb.ApplicationLoadBalancer( + scope, + `${id}-alb`, + consolidatedProps + ); + if (logAccessLogs === undefined || logAccessLogs === true) { + const consolidatedLoggingBucketProps = loggingBucketProps + ? overrideProps(DefaultLoggingBucketProps(), loggingBucketProps) + : DefaultLoggingBucketProps(); + const loggingBucket = createAlbLoggingBucket(scope, id, consolidatedLoggingBucketProps); + loadBalancer.logAccessLogs(loggingBucket); + } + } + return loadBalancer; +} + +export function AddListener( + scope: Construct, + loadBalancer: elb.ApplicationLoadBalancer, + targetGroup: elb.ApplicationTargetGroup, + listenerProps: elb.ApplicationListenerProps | any +): elb.ApplicationListener { + let consolidatedListenerProps: elb.ApplicationListenerProps; + + consolidatedListenerProps = overrideProps( + DefaultListenerProps(loadBalancer), + listenerProps + ); + + // create the listener + const listener = new elb.ApplicationListener( + scope, + "listener", + consolidatedListenerProps + ); + loadBalancer.listeners.push(listener); + + if (consolidatedListenerProps.protocol === elb.ApplicationProtocol.HTTP) { + // This will use core.printWarning in the actual construct + printWarning( + "AWS recommends encrypting traffic to an Application Load Balancer using HTTPS." + ); + if (listenerProps.certificates?.length > 0) { + throw new Error("HTTP listeners cannot use a certificate"); + } + } else { + if (!listenerProps.certificates || listenerProps.certificates.length === 0) { + throw new Error("A listener using HTTPS protocol requires a certificate"); + } + + listener.addCertificates("listener-cert-add", listenerProps.certificates); + } + + if (consolidatedListenerProps.protocol === elb.ApplicationProtocol.HTTPS) { + const opt: elb.RedirectOptions = { + port: "443", + protocol: "HTTPS", + }; + + const httpListener = new elb.ApplicationListener( + scope, + "redirect-listener", + { + loadBalancer, + protocol: ApplicationProtocol.HTTP, + defaultAction: ListenerAction.redirect(opt), + } + ); + loadBalancer.listeners.push(httpListener); + } + + AddTarget(scope, targetGroup, listener); + return listener; +} + +export function CreateLambdaTargetGroup( + scope: Construct, + id: string, + lambdaFunction: lambda.Function, + targetProps?: elb.ApplicationTargetGroupProps +): elb.ApplicationTargetGroup { + const lambdaTarget = new elbt.LambdaTarget(lambdaFunction); + return new elb.ApplicationTargetGroup(scope, `${id}-tg`, { + targets: [lambdaTarget], + targetGroupName: targetProps ? targetProps.targetGroupName : undefined, + healthCheck: targetProps ? targetProps.healthCheck : undefined + }); +} + +export function AddTarget( + scope: Construct, + targetGroup: elb.ApplicationTargetGroup, + listener: elb.ApplicationListener, + ruleProps?: elb.AddRuleProps +) { + // AddRuleProps includes conditions and priority, combine that with targetGroups and + // we can assemble AddApplicationTargetGroupProps + if (ruleProps) { + const consolidatedTargetProps = overrideProps(ruleProps, { targetGroups: [targetGroup] }); + listener.addTargetGroups(`${scope.node.id}-targets`, consolidatedTargetProps); + } else { + listener.addTargetGroups("targets", { + targetGroups: [targetGroup], + }); + } + return; +} diff --git a/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-defaults.ts b/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-defaults.ts index 2ce73bea4..2a7c5c476 100644 --- a/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-defaults.ts +++ b/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-defaults.ts @@ -26,5 +26,14 @@ export function DefaultS3Props(loggingBucket ?: Bucket, lifecycleRules?: s3.Life } as BucketProps; } +export function DefaultLoggingBucketProps(): s3.BucketProps { + return { + encryption: s3.BucketEncryption.S3_MANAGED, + versioned: true, + blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL, + removalPolicy: RemovalPolicy.RETAIN, + } as BucketProps; +} + // Default event types to trigger S3 notifications export const defaultS3NotificationEventTypes = [s3.EventType.OBJECT_CREATED]; diff --git a/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-helper.ts b/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-helper.ts index d65c9ca8e..5c56a15ad 100644 --- a/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-helper.ts +++ b/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-helper.ts @@ -100,6 +100,28 @@ export function createLoggingBucket(scope: Construct, return loggingBucket; } +export function createAlbLoggingBucket(scope: Construct, + bucketId: string, + loggingBucketProps: s3.BucketProps): s3.Bucket { + + // Create the Logging Bucket + const loggingBucket: s3.Bucket = new s3.Bucket(scope, bucketId, loggingBucketProps); + + applySecureBucketPolicy(loggingBucket); + + // Extract the CfnBucket from the loggingBucket + const loggingBucketResource = loggingBucket.node.findChild('Resource') as s3.CfnBucket; + + addCfnSuppressRules(loggingBucketResource, [ + { + id: 'W35', + reason: "This is a log bucket for an Application Load Balancer" + } + ]); + + return loggingBucket; +} + function s3BucketWithLogging(scope: Construct, s3BucketProps?: s3.BucketProps, bucketId?: string, diff --git a/source/patterns/@aws-solutions-constructs/core/package.json b/source/patterns/@aws-solutions-constructs/core/package.json index 689afee3d..a65fab13b 100644 --- a/source/patterns/@aws-solutions-constructs/core/package.json +++ b/source/patterns/@aws-solutions-constructs/core/package.json @@ -55,6 +55,8 @@ "@aws-cdk/aws-cloudfront": "0.0.0", "@aws-cdk/aws-cloudfront-origins": "0.0.0", "@aws-cdk/aws-dynamodb": "0.0.0", + "@aws-cdk/aws-elasticloadbalancingv2": "0.0.0", + "@aws-cdk/aws-elasticloadbalancingv2-targets": "0.0.0", "@aws-cdk/aws-glue": "0.0.0", "@aws-cdk/aws-iot": "0.0.0", "@aws-cdk/aws-kinesis": "0.0.0", diff --git a/source/patterns/@aws-solutions-constructs/core/test/alb-helper.test.ts b/source/patterns/@aws-solutions-constructs/core/test/alb-helper.test.ts new file mode 100644 index 000000000..8e8a504cc --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/core/test/alb-helper.test.ts @@ -0,0 +1,390 @@ +/** + * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance + * with the License. A copy of the License is located at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES + * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +import { Stack } from '@aws-cdk/core'; +import * as elb from "@aws-cdk/aws-elasticloadbalancingv2"; +import * as acm from "@aws-cdk/aws-certificatemanager"; +import * as lambda from "@aws-cdk/aws-lambda"; +import * as defaults from '../index'; +import '@aws-cdk/assert/jest'; + +test('Test ObtainAlb with existing ALB', () => { + const stack = new Stack(); + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + const existingLoadBalancer = new elb.ApplicationLoadBalancer(stack, 'load-balancer', { + vpc, + internetFacing: true, + loadBalancerName: 'unique-name' + }); + + defaults.ObtainAlb(stack, 'test', vpc, true, existingLoadBalancer); + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Name: "unique-name", + }); +}); + +test('Test ObtainAlb for new ALB with provided props', () => { + const stack = new Stack(undefined, undefined, { + env: { account: "123456789012", region: 'us-east-1' }, + }); + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + defaults.ObtainAlb(stack, 'test', vpc, true, undefined, { + loadBalancerName: 'new-loadbalancer', + vpc, + internetFacing: true + }); + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Name: "new-loadbalancer", + Scheme: "internet-facing", + }); +}); + +test('Test ObtainAlb for new ALB with default props', () => { + const stack = new Stack(undefined, undefined, { + env: { account: "123456789012", region: 'us-east-1' }, + }); + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + defaults.ObtainAlb(stack, 'test', vpc, false); + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Scheme: "internal", + }); +}); + +test('Test ObtainAlb for new ALB with default props', () => { + const stack = new Stack(); + + const testFunction = new lambda.Function(stack, 'test-function', { + code: lambda.Code.fromAsset(`${__dirname}/lambda`), + runtime: lambda.Runtime.NODEJS_14_X, + handler: "index.handler", + }); + + defaults.CreateLambdaTargetGroup(stack, 'test-target', testFunction); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::TargetGroup', { + TargetType: "lambda" + }); +}); + +test('Test ObtainAlb for new ALB with custom props', () => { + const stack = new Stack(); + + const testFunction = new lambda.Function(stack, 'test-function', { + code: lambda.Code.fromAsset(`${__dirname}/lambda`), + runtime: lambda.Runtime.NODEJS_14_X, + handler: "index.handler", + }); + + defaults.CreateLambdaTargetGroup(stack, 'test-target', testFunction, { + targetGroupName: 'test-target-group' + }); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::TargetGroup', { + TargetType: "lambda", + Name: 'test-target-group' + }); +}); + +test('Test Add Target without ruleProps', () => { + const stack = new Stack(); + + const testFunction = new lambda.Function(stack, 'test-function', { + code: lambda.Code.fromAsset(`${__dirname}/lambda`), + runtime: lambda.Runtime.NODEJS_14_X, + handler: "index.handler", + }); + + const targetGroup = defaults.CreateLambdaTargetGroup(stack, 'test-target', testFunction, { + targetGroupName: 'test-target-group' + }); + + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + const existingLoadBalancer = new elb.ApplicationLoadBalancer(stack, 'load-balancer', { + vpc, + internetFacing: true, + loadBalancerName: 'unique-name' + }); + + const testListener = new elb.ApplicationListener(stack, 'test-listener', { + loadBalancer: existingLoadBalancer, + protocol: elb.ApplicationProtocol.HTTP + }); + + defaults.AddTarget(stack, targetGroup, testListener); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::Listener', { + DefaultActions: [ + { + TargetGroupArn: { + Ref: "testtargettgB2EE41CA" + }, + Type: "forward" + } + ], + }); +}); + +test('Test Add Target with ruleProps', () => { + const stack = new Stack(); + + const testFunction = new lambda.Function(stack, 'test-function', { + code: lambda.Code.fromAsset(`${__dirname}/lambda`), + runtime: lambda.Runtime.NODEJS_14_X, + handler: "index.handler", + }); + + const targetGroup = defaults.CreateLambdaTargetGroup(stack, 'test-target', testFunction, { + targetGroupName: 'test-target-group' + }); + + const secondTargetGroup = defaults.CreateLambdaTargetGroup(stack, 'second-target', testFunction, { + targetGroupName: 'second-target-group' + }); + + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + const existingLoadBalancer = new elb.ApplicationLoadBalancer(stack, 'load-balancer', { + vpc, + internetFacing: true, + loadBalancerName: 'unique-name' + }); + + const testListener = new elb.ApplicationListener(stack, 'test-listener', { + loadBalancer: existingLoadBalancer, + protocol: elb.ApplicationProtocol.HTTP + }); + + // The first target is default and can't have rules, so + // we need to add 2 targets + defaults.AddTarget(stack, targetGroup, testListener); + defaults.AddTarget(stack, secondTargetGroup, testListener, { + conditions: [elb.ListenerCondition.pathPatterns(["*admin*"])], + priority: 10 + }); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::ListenerRule', { + Actions: [ + { + TargetGroupArn: { + Ref: "secondtargettg0CE37E1F" + }, + Type: "forward" + } + ], + Conditions: [ + { + Field: "path-pattern", + PathPatternConfig: { + Values: [ + "*admin*" + ] + } + } + ] + }); +}); + +test('Test AddListener with defaults', () => { + const stack = new Stack(); + const testFunction = new lambda.Function(stack, 'test-function', { + code: lambda.Code.fromAsset(`${__dirname}/lambda`), + runtime: lambda.Runtime.NODEJS_14_X, + handler: "index.handler", + }); + + const targetGroup = defaults.CreateLambdaTargetGroup(stack, 'test-target', testFunction, { + targetGroupName: 'test-target-group' + }); + + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + const existingLoadBalancer = new elb.ApplicationLoadBalancer(stack, 'load-balancer', { + vpc, + internetFacing: true, + loadBalancerName: 'unique-name' + }); + + const cert = acm.Certificate.fromCertificateArn( + stack, + 'not-really-a-cert', + "arn:aws:acm:us-east-1:123456789012:certificate/85c52dc8-1b37-4afd-a7aa-f03aac2db0cc" + ); + + defaults.AddListener(stack, existingLoadBalancer, targetGroup, { + certificates: [ cert ], + }); + + // This should create 2 listeners, HTTPS plus redirect of HTTP + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::Listener', { + Protocol: 'HTTPS', + }); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::Listener', { + Protocol: 'HTTP', + }); +}); + +test('Test AddListener with no cert for an HTTPS listener', () => { + const stack = new Stack(); + const testFunction = new lambda.Function(stack, 'test-function', { + code: lambda.Code.fromAsset(`${__dirname}/lambda`), + runtime: lambda.Runtime.NODEJS_14_X, + handler: "index.handler", + }); + + const targetGroup = defaults.CreateLambdaTargetGroup(stack, 'test-target', testFunction, { + targetGroupName: 'test-target-group' + }); + + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + const existingLoadBalancer = new elb.ApplicationLoadBalancer(stack, 'load-balancer', { + vpc, + internetFacing: true, + loadBalancerName: 'unique-name' + }); + + const app = () => { + defaults.AddListener(stack, existingLoadBalancer, targetGroup, {}); + }; + expect(app).toThrowError(); +}); + +test('Test AddListener error for HTTP with a cert', () => { + const stack = new Stack(); + const testFunction = new lambda.Function(stack, 'test-function', { + code: lambda.Code.fromAsset(`${__dirname}/lambda`), + runtime: lambda.Runtime.NODEJS_14_X, + handler: "index.handler", + }); + + const targetGroup = defaults.CreateLambdaTargetGroup(stack, 'test-target', testFunction, { + targetGroupName: 'test-target-group' + }); + + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + const existingLoadBalancer = new elb.ApplicationLoadBalancer(stack, 'load-balancer', { + vpc, + internetFacing: true, + loadBalancerName: 'unique-name' + }); + + const cert = acm.Certificate.fromCertificateArn( + stack, + 'not-really-a-cert', + "arn:aws:acm:us-east-1:123456789012:certificate/85c52dc8-1b37-4afd-a7aa-f03aac2db0cc" + ); + + const app = () => { + defaults.AddListener(stack, existingLoadBalancer, targetGroup, { + certificates: [ cert ], + protocol: elb.ApplicationProtocol.HTTP, + }); + }; + expect(app).toThrowError(); + +}); + +test('Test AddListener for HTTP Listener', () => { + const stack = new Stack(); + const testFunction = new lambda.Function(stack, 'test-function', { + code: lambda.Code.fromAsset(`${__dirname}/lambda`), + runtime: lambda.Runtime.NODEJS_14_X, + handler: "index.handler", + }); + + const targetGroup = defaults.CreateLambdaTargetGroup(stack, 'test-target', testFunction, { + targetGroupName: 'test-target-group' + }); + + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + const existingLoadBalancer = new elb.ApplicationLoadBalancer(stack, 'load-balancer', { + vpc, + internetFacing: true, + loadBalancerName: 'unique-name' + }); + + defaults.AddListener(stack, existingLoadBalancer, targetGroup, { + protocol: elb.ApplicationProtocol.HTTP, + }); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::Listener', { + Protocol: 'HTTP', + }); + expect(stack).not.toHaveResourceLike('AWS::ElasticLoadBalancingV2::Listener', { + Protocol: 'HTTPS', + }); +}); + +test('Test with custom logging bucket props', () => { + // Creating ALB logging requires a region and account (but + // these can be fake in unit tests) + const stack = new Stack(undefined, undefined, { + env: { account: "123456789012", region: 'us-east-1' }, + }); + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + const testName = 'test-name'; + + defaults.ObtainAlb(stack, 'test', vpc, false, undefined, undefined, true, { bucketName: testName }); + expect(stack).toHaveResourceLike('AWS::S3::Bucket', { + BucketName: testName + }); +}); + +test('Test with no logging', () => { + const stack = new Stack(); + // Build VPC + const vpc = defaults.buildVpc(stack, { + defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), + }); + + defaults.ObtainAlb(stack, 'test', vpc, false, undefined, undefined, false); + expect(stack).not.toHaveResourceLike('AWS::S3::Bucket', {}); +}); diff --git a/source/patterns/@aws-solutions-constructs/core/test/s3-bucket.test.ts b/source/patterns/@aws-solutions-constructs/core/test/s3-bucket.test.ts index 513fda070..996dc03f3 100644 --- a/source/patterns/@aws-solutions-constructs/core/test/s3-bucket.test.ts +++ b/source/patterns/@aws-solutions-constructs/core/test/s3-bucket.test.ts @@ -142,3 +142,15 @@ test('test s3Bucket override serverAccessLogsBucket', () => { } }); }); + +test('test createAlbLoggingBucket()', () => { + const stack = new Stack(); + + defaults.createAlbLoggingBucket(stack, 'test-bucket', { + bucketName: 'test-name' + }); + + expect(stack).toHaveResource("AWS::S3::Bucket", { + BucketName: 'test-name' + }); +}); From 223da2f3fa0f2fb6aebbb68be33921a132d8b1aa Mon Sep 17 00:00:00 2001 From: biffgaut <78155736+biffgaut@users.noreply.github.com> Date: Tue, 5 Oct 2021 17:51:07 -0400 Subject: [PATCH 02/14] Adjust viperlight --- .viperlightignore | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.viperlightignore b/.viperlightignore index 1812d6097..7985dabef 100644 --- a/.viperlightignore +++ b/.viperlightignore @@ -140,4 +140,8 @@ source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/integ.depl source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/integ.existingEventBus.expected.json:108 source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/integ.existingFunction.expected.json:122 source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/aws-lambda-eventbridge.test.ts:28 -source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/aws-lambda-eventbridge.test.ts:339 \ No newline at end of file +source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/aws-lambda-eventbridge.test.ts:339 +# These are references to the us-east-1 ELBV2 account (publicly known) +source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.expected.json:183 +source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.expected.json:834 +source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json:830 From 54fc7936adad9054c28b17e2d60ae46269fe1e45 Mon Sep 17 00:00:00 2001 From: biffgaut <78155736+biffgaut@users.noreply.github.com> Date: Wed, 6 Oct 2021 09:21:11 -0400 Subject: [PATCH 03/14] Fix first few cfn_nag issues --- .../aws-route53-alb/test/integ.deployPublicApiExistingAlb.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.ts index 55a13d732..831d66ba7 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.ts +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.ts @@ -41,9 +41,10 @@ const newZone = new PublicHostedZone(stack, 'new-zone', { const existingAlb = new ApplicationLoadBalancer(stack, 'test-alb', { vpc: newVpc, - loadBalancerName: 'find-this-name' }); +defaults.addCfnSuppressRules(existingAlb, [{ id: 'W52', reason: 'Test ALB only.'}]); + // Definitions const props: Route53ToAlbProps = { publicApi: true, From 0df6358df306ac0a5663d5a01451834105db90c5 Mon Sep 17 00:00:00 2001 From: biffgaut <78155736+biffgaut@users.noreply.github.com> Date: Wed, 6 Oct 2021 09:56:26 -0400 Subject: [PATCH 04/14] Fix more cfn_nag issues --- .../integ.deployPublicApiExistingAlb.expected.json | 11 ++++++++++- .../test/integ.deployWithoutLogging.expected.json | 10 ++++++++++ .../test/integ.deployWithoutLogging.ts | 5 ++++- 3 files changed, 24 insertions(+), 2 deletions(-) diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.expected.json index 930c86d4d..2348ce232 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.expected.json +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.expected.json @@ -667,7 +667,6 @@ "Value": "false" } ], - "Name": "find-this-name", "Scheme": "internal", "SecurityGroups": [ { @@ -689,6 +688,16 @@ } ], "Type": "application" + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W52", + "reason": "Test ALB only." + } + ] + } } }, "testalbSecurityGroup0C84CDF9": { diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.expected.json index b94a3d612..e0c64f9de 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.expected.json +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.expected.json @@ -45,6 +45,16 @@ } ], "Type": "application" + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W52", + "reason": "This test is explicitly to test the no logging case." + } + ] + } } }, "testroute53albtestroute53albalbSecurityGroupC3716E02": { diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.ts index 8afda2608..59bde9172 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.ts +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.ts @@ -15,6 +15,7 @@ import { App, Stack, Aws } from "@aws-cdk/core"; import { Route53ToAlb, Route53ToAlbProps } from "../lib"; import { generateIntegStackName } from '@aws-solutions-constructs/core'; +import * as defaults from '@aws-solutions-constructs/core'; // Setup const app = new App(); @@ -32,7 +33,9 @@ const props: Route53ToAlbProps = { logAccessLogs: false, }; -new Route53ToAlb(stack, 'test-route53-alb', props); +const testConstruct = new Route53ToAlb(stack, 'test-route53-alb', props); + +defaults.addCfnSuppressRules(testConstruct.loadBalancer, [{ id: 'W52', reason: 'This test is explicitly to test the no logging case.'}]); // Synth app.synth(); \ No newline at end of file From 5a30ae175caa55e699728cfad021f8551a658601 Mon Sep 17 00:00:00 2001 From: biffgaut <78155736+biffgaut@users.noreply.github.com> Date: Wed, 6 Oct 2021 14:18:53 -0400 Subject: [PATCH 05/14] cfn_nag changes --- .../integ.deployPublicApiNewAlb.expected.json | 40 ++++++++----------- .../test/integ.deployPublicApiNewAlb.ts | 9 ++++- 2 files changed, 24 insertions(+), 25 deletions(-) diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json index a428bb0f6..3c859c0de 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json @@ -652,6 +652,22 @@ ] } }, + "emptysecuritygroupA4ADE482": { + "Type": "AWS::EC2::SecurityGroup", + "Properties": { + "GroupDescription": "deployPublicApiNewAlb/empty-security-group", + "SecurityGroupEgress": [ + { + "CidrIp": "0.0.0.0/0", + "Description": "Allow all outbound traffic by default", + "IpProtocol": "-1" + } + ], + "VpcId": { + "Ref": "Vpc8378EB38" + } + } + }, "newzone1D011936": { "Type": "AWS::Route53::HostedZone", "Properties": { @@ -686,7 +702,7 @@ "SecurityGroups": [ { "Fn::GetAtt": [ - "testroute53albtestroute53albalbSecurityGroupC3716E02", + "emptysecuritygroupA4ADE482", "GroupId" ] } @@ -712,28 +728,6 @@ "VpcPublicSubnet3DefaultRoute4697774F" ] }, - "testroute53albtestroute53albalbSecurityGroupC3716E02": { - "Type": "AWS::EC2::SecurityGroup", - "Properties": { - "GroupDescription": "Automatically created Security Group for ELB deployPublicApiNewAlbtestroute53albtestroute53albalbC4C12C26", - "SecurityGroupEgress": [ - { - "CidrIp": "255.255.255.255/32", - "Description": "Disallow all traffic", - "FromPort": 252, - "IpProtocol": "icmp", - "ToPort": 86 - } - ], - "VpcId": { - "Ref": "Vpc8378EB38" - } - }, - "DependsOn": [ - "testroute53albPolicy478FC0AF", - "testroute53albAC463A50" - ] - }, "testroute53albAC463A50": { "Type": "AWS::S3::Bucket", "Properties": { diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts index 9a51b32ba..7e5f9d3f2 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts @@ -13,14 +13,14 @@ // Imports import { App, Stack, Aws } from "@aws-cdk/core"; +import * as ec2 from '@aws-cdk/aws-ec2'; import * as defaults from '@aws-solutions-constructs/core'; import { PublicHostedZone } from "@aws-cdk/aws-route53"; import { Route53ToAlb, Route53ToAlbProps } from "../lib"; -import { generateIntegStackName } from '@aws-solutions-constructs/core'; // Setup const app = new App(); -const stack = new Stack(app, generateIntegStackName(__filename), { +const stack = new Stack(app, defaults.generateIntegStackName(__filename), { env: { account: Aws.ACCOUNT_ID, region: 'us-east-1' }, }); stack.templateOptions.description = 'Integration Test for aws-route53-alb'; @@ -34,6 +34,10 @@ const newVpc = defaults.buildVpc(stack, { }, }); +const emptySecurityGroup = new ec2.SecurityGroup(stack, 'empty-security-group', { + vpc: newVpc +}); + const newZone = new PublicHostedZone(stack, 'new-zone', { zoneName: 'www.test-example.com', }); @@ -45,6 +49,7 @@ const props: Route53ToAlbProps = { existingVpc: newVpc, loadBalancerProps: { loadBalancerName: 'new-alb', + securityGroup: emptySecurityGroup, } }; From 31472a6a2acb0dffbd85b324e57aac6374835617 Mon Sep 17 00:00:00 2001 From: biffgaut <78155736+biffgaut@users.noreply.github.com> Date: Wed, 6 Oct 2021 15:21:41 -0400 Subject: [PATCH 06/14] Fix more cfn_nag issues --- .../integ.deployPublicApiNewAlb.expected.json | 40 +++++++++++-------- .../test/integ.deployPublicApiNewAlb.ts | 6 --- 2 files changed, 23 insertions(+), 23 deletions(-) diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json index 3c859c0de..a428bb0f6 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json @@ -652,22 +652,6 @@ ] } }, - "emptysecuritygroupA4ADE482": { - "Type": "AWS::EC2::SecurityGroup", - "Properties": { - "GroupDescription": "deployPublicApiNewAlb/empty-security-group", - "SecurityGroupEgress": [ - { - "CidrIp": "0.0.0.0/0", - "Description": "Allow all outbound traffic by default", - "IpProtocol": "-1" - } - ], - "VpcId": { - "Ref": "Vpc8378EB38" - } - } - }, "newzone1D011936": { "Type": "AWS::Route53::HostedZone", "Properties": { @@ -702,7 +686,7 @@ "SecurityGroups": [ { "Fn::GetAtt": [ - "emptysecuritygroupA4ADE482", + "testroute53albtestroute53albalbSecurityGroupC3716E02", "GroupId" ] } @@ -728,6 +712,28 @@ "VpcPublicSubnet3DefaultRoute4697774F" ] }, + "testroute53albtestroute53albalbSecurityGroupC3716E02": { + "Type": "AWS::EC2::SecurityGroup", + "Properties": { + "GroupDescription": "Automatically created Security Group for ELB deployPublicApiNewAlbtestroute53albtestroute53albalbC4C12C26", + "SecurityGroupEgress": [ + { + "CidrIp": "255.255.255.255/32", + "Description": "Disallow all traffic", + "FromPort": 252, + "IpProtocol": "icmp", + "ToPort": 86 + } + ], + "VpcId": { + "Ref": "Vpc8378EB38" + } + }, + "DependsOn": [ + "testroute53albPolicy478FC0AF", + "testroute53albAC463A50" + ] + }, "testroute53albAC463A50": { "Type": "AWS::S3::Bucket", "Properties": { diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts index 7e5f9d3f2..90e27504c 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts @@ -13,7 +13,6 @@ // Imports import { App, Stack, Aws } from "@aws-cdk/core"; -import * as ec2 from '@aws-cdk/aws-ec2'; import * as defaults from '@aws-solutions-constructs/core'; import { PublicHostedZone } from "@aws-cdk/aws-route53"; import { Route53ToAlb, Route53ToAlbProps } from "../lib"; @@ -34,10 +33,6 @@ const newVpc = defaults.buildVpc(stack, { }, }); -const emptySecurityGroup = new ec2.SecurityGroup(stack, 'empty-security-group', { - vpc: newVpc -}); - const newZone = new PublicHostedZone(stack, 'new-zone', { zoneName: 'www.test-example.com', }); @@ -49,7 +44,6 @@ const props: Route53ToAlbProps = { existingVpc: newVpc, loadBalancerProps: { loadBalancerName: 'new-alb', - securityGroup: emptySecurityGroup, } }; From 82783b86ff4f6acf63381f923a4185f105dad8e3 Mon Sep 17 00:00:00 2001 From: biffgaut <78155736+biffgaut@users.noreply.github.com> Date: Wed, 6 Oct 2021 16:34:59 -0400 Subject: [PATCH 07/14] Fix more cfn_nag issues --- .../test/integ.deployPrivateApi.expected.json | 52 +++++++++++-------- .../test/integ.deployPrivateApi.ts | 7 ++- ...g.deployPublicApiExistingAlb.expected.json | 12 ++++- .../test/integ.deployPublicApiExistingAlb.ts | 6 ++- .../integ.deployPublicApiNewAlb.expected.json | 48 ++++++++++------- .../test/integ.deployPublicApiNewAlb.ts | 6 ++- .../integ.deployWithoutLogging.expected.json | 28 ++++++---- .../test/integ.deployWithoutLogging.ts | 6 ++- 8 files changed, 111 insertions(+), 54 deletions(-) diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.expected.json index 87aea31e4..c636b74f1 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.expected.json +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.expected.json @@ -1,7 +1,7 @@ { "Description": "Integration Test for aws-route53-alb", "Resources": { - "testroute53albtestroute53albzone04BEDFE6": { + "privateapistackprivateapistackzone3E5194E7": { "Type": "AWS::Route53::HostedZone", "Properties": { "Name": "www.example.com.", @@ -15,7 +15,7 @@ ] } }, - "testroute53albtestroute53albalb7C171F50": { + "privateapistackprivateapistackalb7242E759": { "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", "Properties": { "LoadBalancerAttributes": [ @@ -30,7 +30,7 @@ { "Key": "access_logs.s3.bucket", "Value": { - "Ref": "testroute53albAC463A50" + "Ref": "privateapistack09C932BB" } }, { @@ -42,7 +42,7 @@ "SecurityGroups": [ { "Fn::GetAtt": [ - "testroute53albtestroute53albalbSecurityGroupC3716E02", + "privateapistackprivateapistackalbSecurityGroup5A8A9725", "GroupId" ] } @@ -61,14 +61,14 @@ "Type": "application" }, "DependsOn": [ - "testroute53albPolicy478FC0AF", - "testroute53albAC463A50" + "privateapistackPolicy98558170", + "privateapistack09C932BB" ] }, - "testroute53albtestroute53albalbSecurityGroupC3716E02": { + "privateapistackprivateapistackalbSecurityGroup5A8A9725": { "Type": "AWS::EC2::SecurityGroup", "Properties": { - "GroupDescription": "Automatically created Security Group for ELB deployPrivateApitestroute53albtestroute53albalb1145D1AD", + "GroupDescription": "Automatically created Security Group for ELB deployPrivateApiprivateapistackprivateapistackalb5DF93E18", "SecurityGroupEgress": [ { "CidrIp": "255.255.255.255/32", @@ -83,11 +83,21 @@ } }, "DependsOn": [ - "testroute53albPolicy478FC0AF", - "testroute53albAC463A50" - ] + "privateapistackPolicy98558170", + "privateapistack09C932BB" + ], + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W29", + "reason": "CDK created rule that blocks all traffic." + } + ] + } + } }, - "testroute53albAC463A50": { + "privateapistack09C932BB": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { @@ -122,11 +132,11 @@ } } }, - "testroute53albPolicy478FC0AF": { + "privateapistackPolicy98558170": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { - "Ref": "testroute53albAC463A50" + "Ref": "privateapistack09C932BB" }, "PolicyDocument": { "Statement": [ @@ -148,7 +158,7 @@ [ { "Fn::GetAtt": [ - "testroute53albAC463A50", + "privateapistack09C932BB", "Arn" ] }, @@ -158,7 +168,7 @@ }, { "Fn::GetAtt": [ - "testroute53albAC463A50", + "privateapistack09C932BB", "Arn" ] } @@ -191,7 +201,7 @@ [ { "Fn::GetAtt": [ - "testroute53albAC463A50", + "privateapistack09C932BB", "Arn" ] }, @@ -209,7 +219,7 @@ } } }, - "testroute53albtestroute53albaliasCCC6DDF3": { + "privateapistackprivateapistackalias54E3713F": { "Type": "AWS::Route53::RecordSet", "Properties": { "Name": "www.example.com.", @@ -222,7 +232,7 @@ "dualstack.", { "Fn::GetAtt": [ - "testroute53albtestroute53albalb7C171F50", + "privateapistackprivateapistackalb7242E759", "DNSName" ] } @@ -231,13 +241,13 @@ }, "HostedZoneId": { "Fn::GetAtt": [ - "testroute53albtestroute53albalb7C171F50", + "privateapistackprivateapistackalb7242E759", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { - "Ref": "testroute53albtestroute53albzone04BEDFE6" + "Ref": "privateapistackprivateapistackzone3E5194E7" } } }, diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.ts index c3202b758..d42a2a964 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.ts +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.ts @@ -15,6 +15,8 @@ import { App, Stack, Aws } from "@aws-cdk/core"; import { Route53ToAlb, Route53ToAlbProps } from "../lib"; import { generateIntegStackName } from '@aws-solutions-constructs/core'; +import * as defaults from '@aws-solutions-constructs/core'; +import { CfnSecurityGroup } from "@aws-cdk/aws-ec2"; // Setup const app = new App(); @@ -31,7 +33,10 @@ const props: Route53ToAlbProps = { } }; -new Route53ToAlb(stack, 'test-route53-alb', props); +const testConstruct = new Route53ToAlb(stack, 'private-api-stack', props); + +const newSecurityGroup = testConstruct.loadBalancer.connections.securityGroups[0].node.defaultChild as CfnSecurityGroup; +defaults.addCfnSuppressRules(newSecurityGroup, [{ id: 'W29', reason: 'CDK created rule that blocks all traffic.'}]); // Synth app.synth(); \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.expected.json index 2348ce232..b6c97fb8b 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.expected.json +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.expected.json @@ -716,9 +716,19 @@ "VpcId": { "Ref": "Vpc8378EB38" } + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W29", + "reason": "CDK created rule that blocks all traffic." + } + ] + } } }, - "testroute53albtestroute53albaliasCCC6DDF3": { + "publicapistackpublicapistackalias4096038C": { "Type": "AWS::Route53::RecordSet", "Properties": { "Name": "www.test-example.com.", diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.ts index 831d66ba7..e97ffe3a0 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.ts +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiExistingAlb.ts @@ -18,6 +18,7 @@ import { ApplicationLoadBalancer } from "@aws-cdk/aws-elasticloadbalancingv2"; import { PublicHostedZone } from "@aws-cdk/aws-route53"; import { Route53ToAlb, Route53ToAlbProps } from "../lib"; import { generateIntegStackName } from '@aws-solutions-constructs/core'; +import { CfnSecurityGroup } from "@aws-cdk/aws-ec2"; // Setup const app = new App(); @@ -53,7 +54,10 @@ const props: Route53ToAlbProps = { existingLoadBalancerObj: existingAlb, }; -new Route53ToAlb(stack, 'test-route53-alb', props); +const testConstruct = new Route53ToAlb(stack, 'public-api-stack', props); + +const newSecurityGroup = testConstruct.loadBalancer.connections.securityGroups[0].node.defaultChild as CfnSecurityGroup; +defaults.addCfnSuppressRules(newSecurityGroup, [{ id: 'W29', reason: 'CDK created rule that blocks all traffic.'}]); // Synth app.synth(); \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json index a428bb0f6..e38957461 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json @@ -658,7 +658,7 @@ "Name": "www.test-example.com." } }, - "testroute53albtestroute53albalb7C171F50": { + "newalbstacknewalbstackalb50B67E3E": { "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", "Properties": { "LoadBalancerAttributes": [ @@ -673,7 +673,7 @@ { "Key": "access_logs.s3.bucket", "Value": { - "Ref": "testroute53albAC463A50" + "Ref": "newalbstackADB02838" } }, { @@ -686,7 +686,7 @@ "SecurityGroups": [ { "Fn::GetAtt": [ - "testroute53albtestroute53albalbSecurityGroupC3716E02", + "newalbstacknewalbstackalbSecurityGroup7BBB827C", "GroupId" ] } @@ -705,17 +705,17 @@ "Type": "application" }, "DependsOn": [ - "testroute53albPolicy478FC0AF", - "testroute53albAC463A50", + "newalbstackPolicyB7C2D898", + "newalbstackADB02838", "VpcPublicSubnet1DefaultRoute3DA9E72A", "VpcPublicSubnet2DefaultRoute97F91067", "VpcPublicSubnet3DefaultRoute4697774F" ] }, - "testroute53albtestroute53albalbSecurityGroupC3716E02": { + "newalbstacknewalbstackalbSecurityGroup7BBB827C": { "Type": "AWS::EC2::SecurityGroup", "Properties": { - "GroupDescription": "Automatically created Security Group for ELB deployPublicApiNewAlbtestroute53albtestroute53albalbC4C12C26", + "GroupDescription": "Automatically created Security Group for ELB deployPublicApiNewAlbnewalbstacknewalbstackalbC987D9E9", "SecurityGroupEgress": [ { "CidrIp": "255.255.255.255/32", @@ -730,11 +730,21 @@ } }, "DependsOn": [ - "testroute53albPolicy478FC0AF", - "testroute53albAC463A50" - ] + "newalbstackPolicyB7C2D898", + "newalbstackADB02838" + ], + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W29", + "reason": "CDK created rule that blocks all traffic." + } + ] + } + } }, - "testroute53albAC463A50": { + "newalbstackADB02838": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { @@ -769,11 +779,11 @@ } } }, - "testroute53albPolicy478FC0AF": { + "newalbstackPolicyB7C2D898": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { - "Ref": "testroute53albAC463A50" + "Ref": "newalbstackADB02838" }, "PolicyDocument": { "Statement": [ @@ -795,7 +805,7 @@ [ { "Fn::GetAtt": [ - "testroute53albAC463A50", + "newalbstackADB02838", "Arn" ] }, @@ -805,7 +815,7 @@ }, { "Fn::GetAtt": [ - "testroute53albAC463A50", + "newalbstackADB02838", "Arn" ] } @@ -838,7 +848,7 @@ [ { "Fn::GetAtt": [ - "testroute53albAC463A50", + "newalbstackADB02838", "Arn" ] }, @@ -856,7 +866,7 @@ } } }, - "testroute53albtestroute53albaliasCCC6DDF3": { + "newalbstacknewalbstackalias05E0DF53": { "Type": "AWS::Route53::RecordSet", "Properties": { "Name": "www.test-example.com.", @@ -869,7 +879,7 @@ "dualstack.", { "Fn::GetAtt": [ - "testroute53albtestroute53albalb7C171F50", + "newalbstacknewalbstackalb50B67E3E", "DNSName" ] } @@ -878,7 +888,7 @@ }, "HostedZoneId": { "Fn::GetAtt": [ - "testroute53albtestroute53albalb7C171F50", + "newalbstacknewalbstackalb50B67E3E", "CanonicalHostedZoneID" ] } diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts index 90e27504c..f70f69287 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts @@ -16,6 +16,7 @@ import { App, Stack, Aws } from "@aws-cdk/core"; import * as defaults from '@aws-solutions-constructs/core'; import { PublicHostedZone } from "@aws-cdk/aws-route53"; import { Route53ToAlb, Route53ToAlbProps } from "../lib"; +import { CfnSecurityGroup } from "@aws-cdk/aws-ec2"; // Setup const app = new App(); @@ -47,7 +48,10 @@ const props: Route53ToAlbProps = { } }; -new Route53ToAlb(stack, 'test-route53-alb', props); +const testConstruct = new Route53ToAlb(stack, 'new-alb-stack', props); + +const newSecurityGroup = testConstruct.loadBalancer.connections.securityGroups[0].node.defaultChild as CfnSecurityGroup; +defaults.addCfnSuppressRules(newSecurityGroup, [{ id: 'W29', reason: 'CDK created rule that blocks all traffic.'}]); // Synth app.synth(); \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.expected.json index e0c64f9de..ff6a4e693 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.expected.json +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.expected.json @@ -1,7 +1,7 @@ { "Description": "Integration Test for aws-route53-alb", "Resources": { - "testroute53albtestroute53albzone04BEDFE6": { + "nologgingstacknologgingstackzoneE11B9175": { "Type": "AWS::Route53::HostedZone", "Properties": { "Name": "www.example.com.", @@ -15,7 +15,7 @@ ] } }, - "testroute53albtestroute53albalb7C171F50": { + "nologgingstacknologgingstackalbFD11E34A": { "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", "Properties": { "LoadBalancerAttributes": [ @@ -28,7 +28,7 @@ "SecurityGroups": [ { "Fn::GetAtt": [ - "testroute53albtestroute53albalbSecurityGroupC3716E02", + "nologgingstacknologgingstackalbSecurityGroup1C3487C4", "GroupId" ] } @@ -57,10 +57,10 @@ } } }, - "testroute53albtestroute53albalbSecurityGroupC3716E02": { + "nologgingstacknologgingstackalbSecurityGroup1C3487C4": { "Type": "AWS::EC2::SecurityGroup", "Properties": { - "GroupDescription": "Automatically created Security Group for ELB deployWithoutLoggingtestroute53albtestroute53albalbF6630861", + "GroupDescription": "Automatically created Security Group for ELB deployWithoutLoggingnologgingstacknologgingstackalbBA718BE3", "SecurityGroupEgress": [ { "CidrIp": "255.255.255.255/32", @@ -73,9 +73,19 @@ "VpcId": { "Ref": "Vpc8378EB38" } + }, + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W29", + "reason": "CDK created rule that blocks all traffic." + } + ] + } } }, - "testroute53albtestroute53albaliasCCC6DDF3": { + "nologgingstacknologgingstackalias0D6EE5FC": { "Type": "AWS::Route53::RecordSet", "Properties": { "Name": "www.example.com.", @@ -88,7 +98,7 @@ "dualstack.", { "Fn::GetAtt": [ - "testroute53albtestroute53albalb7C171F50", + "nologgingstacknologgingstackalbFD11E34A", "DNSName" ] } @@ -97,13 +107,13 @@ }, "HostedZoneId": { "Fn::GetAtt": [ - "testroute53albtestroute53albalb7C171F50", + "nologgingstacknologgingstackalbFD11E34A", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { - "Ref": "testroute53albtestroute53albzone04BEDFE6" + "Ref": "nologgingstacknologgingstackzoneE11B9175" } } }, diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.ts index 59bde9172..bc4bcf94b 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.ts +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployWithoutLogging.ts @@ -16,6 +16,7 @@ import { App, Stack, Aws } from "@aws-cdk/core"; import { Route53ToAlb, Route53ToAlbProps } from "../lib"; import { generateIntegStackName } from '@aws-solutions-constructs/core'; import * as defaults from '@aws-solutions-constructs/core'; +import { CfnSecurityGroup } from "@aws-cdk/aws-ec2"; // Setup const app = new App(); @@ -33,7 +34,10 @@ const props: Route53ToAlbProps = { logAccessLogs: false, }; -const testConstruct = new Route53ToAlb(stack, 'test-route53-alb', props); +const testConstruct = new Route53ToAlb(stack, 'no-logging-stack', props); + +const newSecurityGroup = testConstruct.loadBalancer.connections.securityGroups[0].node.defaultChild as CfnSecurityGroup; +defaults.addCfnSuppressRules(newSecurityGroup, [{ id: 'W29', reason: 'CDK created rule that blocks all traffic.'}]); defaults.addCfnSuppressRules(testConstruct.loadBalancer, [{ id: 'W52', reason: 'This test is explicitly to test the no logging case.'}]); From b89382ef86aefadce859d6831c69b61219ad2177 Mon Sep 17 00:00:00 2001 From: biffgaut <78155736+biffgaut@users.noreply.github.com> Date: Wed, 6 Oct 2021 16:54:21 -0400 Subject: [PATCH 08/14] Viperlight adjustments --- .viperlightignore | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.viperlightignore b/.viperlightignore index 7985dabef..1462a0f3f 100644 --- a/.viperlightignore +++ b/.viperlightignore @@ -142,6 +142,6 @@ source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/integ.exis source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/aws-lambda-eventbridge.test.ts:28 source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/aws-lambda-eventbridge.test.ts:339 # These are references to the us-east-1 ELBV2 account (publicly known) -source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.expected.json:183 +source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.expected.json:193 source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.expected.json:834 -source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json:830 +source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json:840 From 85346df30c1468bcb982ab210274b1bc9fd64a75 Mon Sep 17 00:00:00 2001 From: biffgaut <78155736+biffgaut@users.noreply.github.com> Date: Wed, 6 Oct 2021 17:52:28 -0400 Subject: [PATCH 09/14] Fix more cfn_nag issues --- ...deployPrivateApiExistingZone.expected.json | 48 +++++++++++-------- .../integ.deployPrivateApiExistingZone.ts | 10 ++-- .../integ.deployPublicApiNewAlb.expected.json | 1 - .../test/integ.deployPublicApiNewAlb.ts | 3 -- 4 files changed, 36 insertions(+), 26 deletions(-) diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.expected.json index f8d9f5a95..66affb07f 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.expected.json +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.expected.json @@ -666,7 +666,7 @@ ] } }, - "testroute53albtestroute53albalb7C171F50": { + "existingzonestackexistingzonestackalbCFB3D7E4": { "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", "Properties": { "LoadBalancerAttributes": [ @@ -681,7 +681,7 @@ { "Key": "access_logs.s3.bucket", "Value": { - "Ref": "testroute53albAC463A50" + "Ref": "existingzonestackEFB9F5B3" } }, { @@ -693,7 +693,7 @@ "SecurityGroups": [ { "Fn::GetAtt": [ - "testroute53albtestroute53albalbSecurityGroupC3716E02", + "existingzonestackexistingzonestackalbSecurityGroup6F32DCA5", "GroupId" ] } @@ -712,14 +712,14 @@ "Type": "application" }, "DependsOn": [ - "testroute53albPolicy478FC0AF", - "testroute53albAC463A50" + "existingzonestackPolicyFEC9C88E", + "existingzonestackEFB9F5B3" ] }, - "testroute53albtestroute53albalbSecurityGroupC3716E02": { + "existingzonestackexistingzonestackalbSecurityGroup6F32DCA5": { "Type": "AWS::EC2::SecurityGroup", "Properties": { - "GroupDescription": "Automatically created Security Group for ELB deployPrivateApiExistingZonetestroute53albtestroute53albalb73DF0A20", + "GroupDescription": "Automatically created Security Group for ELB deployPrivateApiExistingZoneexistingzonestackexistingzonestackalbFBEA12EB", "SecurityGroupEgress": [ { "CidrIp": "255.255.255.255/32", @@ -734,11 +734,21 @@ } }, "DependsOn": [ - "testroute53albPolicy478FC0AF", - "testroute53albAC463A50" - ] + "existingzonestackPolicyFEC9C88E", + "existingzonestackEFB9F5B3" + ], + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W29", + "reason": "CDK created rule that blocks all traffic." + } + ] + } + } }, - "testroute53albAC463A50": { + "existingzonestackEFB9F5B3": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { @@ -773,11 +783,11 @@ } } }, - "testroute53albPolicy478FC0AF": { + "existingzonestackPolicyFEC9C88E": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { - "Ref": "testroute53albAC463A50" + "Ref": "existingzonestackEFB9F5B3" }, "PolicyDocument": { "Statement": [ @@ -799,7 +809,7 @@ [ { "Fn::GetAtt": [ - "testroute53albAC463A50", + "existingzonestackEFB9F5B3", "Arn" ] }, @@ -809,7 +819,7 @@ }, { "Fn::GetAtt": [ - "testroute53albAC463A50", + "existingzonestackEFB9F5B3", "Arn" ] } @@ -842,7 +852,7 @@ [ { "Fn::GetAtt": [ - "testroute53albAC463A50", + "existingzonestackEFB9F5B3", "Arn" ] }, @@ -860,7 +870,7 @@ } } }, - "testroute53albtestroute53albaliasCCC6DDF3": { + "existingzonestackexistingzonestackalias77D2E65D": { "Type": "AWS::Route53::RecordSet", "Properties": { "Name": "www.test-example.com.", @@ -873,7 +883,7 @@ "dualstack.", { "Fn::GetAtt": [ - "testroute53albtestroute53albalb7C171F50", + "existingzonestackexistingzonestackalbCFB3D7E4", "DNSName" ] } @@ -882,7 +892,7 @@ }, "HostedZoneId": { "Fn::GetAtt": [ - "testroute53albtestroute53albalb7C171F50", + "existingzonestackexistingzonestackalbCFB3D7E4", "CanonicalHostedZoneID" ] } diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.ts index 9dc2598ab..4883dd117 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.ts +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.ts @@ -16,11 +16,11 @@ import { App, Stack, Aws } from "@aws-cdk/core"; import * as defaults from '@aws-solutions-constructs/core'; import { PrivateHostedZone } from "@aws-cdk/aws-route53"; import { Route53ToAlb, Route53ToAlbProps } from "../lib"; -import { generateIntegStackName } from '@aws-solutions-constructs/core'; +import { CfnSecurityGroup } from "@aws-cdk/aws-ec2"; // Setup const app = new App(); -const stack = new Stack(app, generateIntegStackName(__filename), { +const stack = new Stack(app, defaults.generateIntegStackName(__filename), { env: { account: Aws.ACCOUNT_ID, region: 'us-east-1' }, }); stack.templateOptions.description = 'Integration Test for aws-route53-alb'; @@ -46,7 +46,11 @@ const props: Route53ToAlbProps = { existingVpc: newVpc, }; -new Route53ToAlb(stack, 'test-route53-alb', props); +const testConstruct = new Route53ToAlb(stack, 'existing-zone-stack', props); + +const newSecurityGroup = testConstruct.loadBalancer.connections.securityGroups[0].node.defaultChild as CfnSecurityGroup; +defaults.addCfnSuppressRules(newSecurityGroup, [{ id: 'W29', reason: 'CDK created rule that blocks all traffic.'}]); + // Synth app.synth(); \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json index e38957461..f5d8b601b 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json @@ -681,7 +681,6 @@ "Value": "" } ], - "Name": "new-alb", "Scheme": "internet-facing", "SecurityGroups": [ { diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts index f70f69287..40f3e496a 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts @@ -43,9 +43,6 @@ const props: Route53ToAlbProps = { publicApi: true, existingHostedZoneInterface: newZone, existingVpc: newVpc, - loadBalancerProps: { - loadBalancerName: 'new-alb', - } }; const testConstruct = new Route53ToAlb(stack, 'new-alb-stack', props); From f3bc0220390114c176f8e8e267246da044aedcaf Mon Sep 17 00:00:00 2001 From: biffgaut <78155736+biffgaut@users.noreply.github.com> Date: Wed, 6 Oct 2021 19:13:16 -0400 Subject: [PATCH 10/14] Viperlight adjustments --- .viperlightignore | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.viperlightignore b/.viperlightignore index 1462a0f3f..9a7c8cc93 100644 --- a/.viperlightignore +++ b/.viperlightignore @@ -143,5 +143,5 @@ source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/aws-lambda source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/aws-lambda-eventbridge.test.ts:339 # These are references to the us-east-1 ELBV2 account (publicly known) source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.expected.json:193 -source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.expected.json:834 -source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json:840 +source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.expected.json:844 +source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json:839 From 5ecfaa4ffa10ba71208004b97490dbe3a7636f64 Mon Sep 17 00:00:00 2001 From: biffgaut <78155736+biffgaut@users.noreply.github.com> Date: Wed, 6 Oct 2021 19:20:45 -0400 Subject: [PATCH 11/14] Lint trivia --- .../aws-route53-alb/test/integ.deployPrivateApiExistingZone.ts | 1 - 1 file changed, 1 deletion(-) diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.ts index 4883dd117..85c8ffee8 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.ts +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.ts @@ -51,6 +51,5 @@ const testConstruct = new Route53ToAlb(stack, 'existing-zone-stack', props); const newSecurityGroup = testConstruct.loadBalancer.connections.securityGroups[0].node.defaultChild as CfnSecurityGroup; defaults.addCfnSuppressRules(newSecurityGroup, [{ id: 'W29', reason: 'CDK created rule that blocks all traffic.'}]); - // Synth app.synth(); \ No newline at end of file From 9abdefedef0c650b5d1556b6478406cb17340fce Mon Sep 17 00:00:00 2001 From: biffgaut <78155736+biffgaut@users.noreply.github.com> Date: Wed, 13 Oct 2021 09:36:41 -0400 Subject: [PATCH 12/14] Address review comments --- package-lock.json | 34 +++++++++++++++++++ .../aws-route53-alb/README.md | 14 +++----- .../aws-route53-alb/lib/index.ts | 2 +- .../test/integ.deployPublicApiNewAlb.ts | 10 ------ .../aws-route53-alb/test/route53-alb.test.ts | 18 ++++++++++ 5 files changed, 58 insertions(+), 20 deletions(-) create mode 100644 package-lock.json diff --git a/package-lock.json b/package-lock.json new file mode 100644 index 000000000..56d8b5a65 --- /dev/null +++ b/package-lock.json @@ -0,0 +1,34 @@ +{ + "requires": true, + "lockfileVersion": 1, + "dependencies": { + "eslint-plugin-mocha": { + "version": "9.0.0", + "resolved": "https://registry.npmjs.org/eslint-plugin-mocha/-/eslint-plugin-mocha-9.0.0.tgz", + "integrity": "sha512-d7knAcQj1jPCzZf3caeBIn3BnW6ikcvfz0kSqQpwPYcVGLoJV5sz0l0OJB2LR8I7dvTDbqq1oV6ylhSgzA10zg==", + "dev": true, + "requires": { + "eslint-utils": "^3.0.0", + "ramda": "^0.27.1" + } + }, + "eslint-utils": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/eslint-utils/-/eslint-utils-3.0.0.tgz", + "integrity": "sha512-uuQC43IGctw68pJA1RgbQS8/NP7rch6Cwd4j3ZBtgo4/8Flj4eGE7ZYSZRN3iq5pVUv6GPdW5Z1RFleo84uLDA==", + "requires": { + "eslint-visitor-keys": "^2.0.0" + } + }, + "eslint-visitor-keys": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-2.1.0.tgz", + "integrity": "sha512-0rSmRBzXgDzIsD6mGdJgevzgezI534Cer5L/vyMX0kHzT/jiB43jRhd9YUlMGYLQy2zprNmoT8qasCGtY+QaKw==" + }, + "ramda": { + "version": "0.27.1", + "resolved": "https://registry.npmjs.org/ramda/-/ramda-0.27.1.tgz", + "integrity": "sha512-PgIdVpn5y5Yns8vqb8FzBUEYn98V3xcPgawAkkgj0YJ0qDsnHCiNmZYfOGMgOvoB0eWFLpYbhxUR3mxfDIMvpw==" + } + } +} diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/README.md b/source/patterns/@aws-solutions-constructs/aws-route53-alb/README.md index 295318507..607ad807d 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/README.md +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/README.md @@ -51,17 +51,10 @@ _Parameters_ * props [`Route53ToAlbProps`](#pattern-construct-props) ## Pattern Construct Props - // If no existingHostedZone, must send hostedZoneProps with at least zoneName - // Public APIs require an existing Hosted Zone to be passed in as the amount of - // DNS configuration required can't use any defaults and require a complex - // Construct hierarchy to define - at that point the client should just instantiate it. - // Private APIs can accept props and create a new Private Hosted Zone. +This construct cannot create a new Public Hosted Zone, if you are creating a public API you must supply an existing Public Hosted Zone that will be reconfigured with a new Alias record. Public Hosted Zones are configured with public domain names and are not well suited to be launched and torn down dynamically, so this construct will only reconfigure existing Public Hosted Zones. - // drives multiple settings in construct, including - // alb.internetFacing and hostedZone creation - // This is a construct level attribute, define it here and not - // at lower level service props +This construct can create Private Hosted Zones. If you want a Private Hosted Zone, then you can either provide an existing Private Hosted Zone or a privateHostedZoneProps value with at least the Domain Name defined. | **Name** | **Type** | **Description** | |:-------------|:----------------|-----------------| @@ -71,6 +64,9 @@ _Parameters_ | existingLoadBalancerObj? | [elasticloadbalancingv2.ApplicationLoadBalancer](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html) | Existing Application Load Balancer to incorporate into the construct architecture. Providing both this and loadBalancerProps is an error. The VPC containing this loadBalancer must match the VPC provided in existingVpc. | | vpcProps? | [ec2.VpcProps](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-ec2.VpcProps.html) | Optional custom properties for a VPC the construct will create. This VPC will be used by the new ALB and any Private Hosted Zone the construct creates (that's why loadBalancerProps and privateHostedZoneProps can't include a VPC). Providing both this and existingVpc is an error. | | existingVpc? | [ec2.IVpc](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-ec2.IVpc.html) | An existing VPC in which to deploy the construct. Providing both this and vpcProps is an error. If the client provides an existing load balancer and/or existing Private Hosted Zone, those constructs must exist in this VPC. | +| logAccessLogs? | boolean| Whether to turn on Access Logs for the Application Load Balancer. Uses an S3 bucket with associated storage costs.Enabling Access Logging is a best practice. default - true | +| loggingBucketProps? | [s3.BucketProps](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-s3.BucketProps.html) | Optional properties to customize the bucket used to store the ALB Access Logs. Supplying this and setting logAccessLogs to false is an error. @default - none | + | publicApi | boolean | Whether the construct is deploying a private or public API. This has implications for the Hosted Zone, VPC and ALB. | diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/lib/index.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/lib/index.ts index 29b05f6c6..0f2d0ba97 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/lib/index.ts +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/lib/index.ts @@ -97,7 +97,7 @@ export class Route53ToAlb extends Construct { public readonly loadBalancer: elb.ApplicationLoadBalancer; /** - * @summary Constructs a new instance of the LambdaToStepfunctionsProps class. + * @summary Constructs a new instance of the Route53ToAlb class. * @param {cdk.App} scope - represents the scope for all the resources. * @param {string} id - this is a a scope-unique id. * @param {Route53ToAlbProps} props - user provided props for the construct. diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts index 40f3e496a..35f8e4d91 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.ts @@ -25,15 +25,6 @@ const stack = new Stack(app, defaults.generateIntegStackName(__filename), { }); stack.templateOptions.description = 'Integration Test for aws-route53-alb'; -const newVpc = defaults.buildVpc(stack, { - defaultVpcProps: defaults.DefaultPublicPrivateVpcProps(), - constructVpcProps: { - enableDnsHostnames: true, - enableDnsSupport: true, - cidr: '172.168.0.0/16', - }, -}); - const newZone = new PublicHostedZone(stack, 'new-zone', { zoneName: 'www.test-example.com', }); @@ -42,7 +33,6 @@ const newZone = new PublicHostedZone(stack, 'new-zone', { const props: Route53ToAlbProps = { publicApi: true, existingHostedZoneInterface: newZone, - existingVpc: newVpc, }; const testConstruct = new Route53ToAlb(stack, 'new-alb-stack', props); diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/route53-alb.test.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/route53-alb.test.ts index e3fb1596b..f319df513 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/route53-alb.test.ts +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/route53-alb.test.ts @@ -382,3 +382,21 @@ test('Test providing an existingLoadBalancer', () => { }); }); + +test('Check publicApi and without an existing hosted zone is an error', () => { + // Initial Setup + const stack = new Stack(); + + const testExistingVpc = getTestVpc(stack); + + const props: Route53ToAlbProps = { + publicApi: true, + existingVpc: testExistingVpc, + }; + + const app = () => { + new Route53ToAlb(stack, 'test-error', props); + }; + // Assertion + expect(app).toThrowError(); +}); From 4e1b1f5141aeb5cc37e55ac150cb79bbabc33ae1 Mon Sep 17 00:00:00 2001 From: biffgaut <78155736+biffgaut@users.noreply.github.com> Date: Wed, 13 Oct 2021 14:38:25 -0400 Subject: [PATCH 13/14] Address review comments --- .../integ.deployPublicApiNewAlb.expected.json | 504 +++++++++--------- .../aws-route53-alb/test/route53-alb.test.ts | 32 ++ .../core/lib/alb-helper.ts | 2 +- 3 files changed, 285 insertions(+), 253 deletions(-) diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json index f5d8b601b..095a9fa5b 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json @@ -1,10 +1,255 @@ { "Description": "Integration Test for aws-route53-alb", "Resources": { + "newzone1D011936": { + "Type": "AWS::Route53::HostedZone", + "Properties": { + "Name": "www.test-example.com." + } + }, + "newalbstacknewalbstackalb50B67E3E": { + "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", + "Properties": { + "LoadBalancerAttributes": [ + { + "Key": "deletion_protection.enabled", + "Value": "false" + }, + { + "Key": "access_logs.s3.enabled", + "Value": "true" + }, + { + "Key": "access_logs.s3.bucket", + "Value": { + "Ref": "newalbstackADB02838" + } + }, + { + "Key": "access_logs.s3.prefix", + "Value": "" + } + ], + "Scheme": "internet-facing", + "SecurityGroups": [ + { + "Fn::GetAtt": [ + "newalbstacknewalbstackalbSecurityGroup7BBB827C", + "GroupId" + ] + } + ], + "Subnets": [ + { + "Ref": "VpcPublicSubnet1Subnet5C2D37C4" + }, + { + "Ref": "VpcPublicSubnet2Subnet691E08A3" + }, + { + "Ref": "VpcPublicSubnet3SubnetBE12F0B6" + } + ], + "Type": "application" + }, + "DependsOn": [ + "newalbstackPolicyB7C2D898", + "newalbstackADB02838", + "VpcPublicSubnet1DefaultRoute3DA9E72A", + "VpcPublicSubnet2DefaultRoute97F91067", + "VpcPublicSubnet3DefaultRoute4697774F" + ] + }, + "newalbstacknewalbstackalbSecurityGroup7BBB827C": { + "Type": "AWS::EC2::SecurityGroup", + "Properties": { + "GroupDescription": "Automatically created Security Group for ELB deployPublicApiNewAlbnewalbstacknewalbstackalbC987D9E9", + "SecurityGroupEgress": [ + { + "CidrIp": "255.255.255.255/32", + "Description": "Disallow all traffic", + "FromPort": 252, + "IpProtocol": "icmp", + "ToPort": 86 + } + ], + "VpcId": { + "Ref": "Vpc8378EB38" + } + }, + "DependsOn": [ + "newalbstackPolicyB7C2D898", + "newalbstackADB02838" + ], + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W29", + "reason": "CDK created rule that blocks all traffic." + } + ] + } + } + }, + "newalbstackADB02838": { + "Type": "AWS::S3::Bucket", + "Properties": { + "BucketEncryption": { + "ServerSideEncryptionConfiguration": [ + { + "ServerSideEncryptionByDefault": { + "SSEAlgorithm": "AES256" + } + } + ] + }, + "PublicAccessBlockConfiguration": { + "BlockPublicAcls": true, + "BlockPublicPolicy": true, + "IgnorePublicAcls": true, + "RestrictPublicBuckets": true + }, + "VersioningConfiguration": { + "Status": "Enabled" + } + }, + "UpdateReplacePolicy": "Retain", + "DeletionPolicy": "Retain", + "Metadata": { + "cfn_nag": { + "rules_to_suppress": [ + { + "id": "W35", + "reason": "This is a log bucket for an Application Load Balancer" + } + ] + } + } + }, + "newalbstackPolicyB7C2D898": { + "Type": "AWS::S3::BucketPolicy", + "Properties": { + "Bucket": { + "Ref": "newalbstackADB02838" + }, + "PolicyDocument": { + "Statement": [ + { + "Action": "*", + "Condition": { + "Bool": { + "aws:SecureTransport": "false" + } + }, + "Effect": "Deny", + "Principal": { + "AWS": "*" + }, + "Resource": [ + { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "newalbstackADB02838", + "Arn" + ] + }, + "/*" + ] + ] + }, + { + "Fn::GetAtt": [ + "newalbstackADB02838", + "Arn" + ] + } + ], + "Sid": "HttpsOnly" + }, + { + "Action": [ + "s3:PutObject", + "s3:Abort*" + ], + "Effect": "Allow", + "Principal": { + "AWS": { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::127311923021:root" + ] + ] + } + }, + "Resource": { + "Fn::Join": [ + "", + [ + { + "Fn::GetAtt": [ + "newalbstackADB02838", + "Arn" + ] + }, + "/AWSLogs/", + { + "Ref": "AWS::AccountId" + }, + "/*" + ] + ] + } + } + ], + "Version": "2012-10-17" + } + } + }, + "newalbstacknewalbstackalias05E0DF53": { + "Type": "AWS::Route53::RecordSet", + "Properties": { + "Name": "www.test-example.com.", + "Type": "A", + "AliasTarget": { + "DNSName": { + "Fn::Join": [ + "", + [ + "dualstack.", + { + "Fn::GetAtt": [ + "newalbstacknewalbstackalb50B67E3E", + "DNSName" + ] + } + ] + ] + }, + "HostedZoneId": { + "Fn::GetAtt": [ + "newalbstacknewalbstackalb50B67E3E", + "CanonicalHostedZoneID" + ] + } + }, + "HostedZoneId": { + "Ref": "newzone1D011936" + } + } + }, "Vpc8378EB38": { "Type": "AWS::EC2::VPC", "Properties": { - "CidrBlock": "172.168.0.0/16", + "CidrBlock": "10.0.0.0/16", "EnableDnsHostnames": true, "EnableDnsSupport": true, "InstanceTenancy": "default", @@ -19,7 +264,7 @@ "VpcPublicSubnet1Subnet5C2D37C4": { "Type": "AWS::EC2::Subnet", "Properties": { - "CidrBlock": "172.168.0.0/19", + "CidrBlock": "10.0.0.0/19", "VpcId": { "Ref": "Vpc8378EB38" }, @@ -126,7 +371,7 @@ "VpcPublicSubnet2Subnet691E08A3": { "Type": "AWS::EC2::Subnet", "Properties": { - "CidrBlock": "172.168.32.0/19", + "CidrBlock": "10.0.32.0/19", "VpcId": { "Ref": "Vpc8378EB38" }, @@ -233,7 +478,7 @@ "VpcPublicSubnet3SubnetBE12F0B6": { "Type": "AWS::EC2::Subnet", "Properties": { - "CidrBlock": "172.168.64.0/19", + "CidrBlock": "10.0.64.0/19", "VpcId": { "Ref": "Vpc8378EB38" }, @@ -340,7 +585,7 @@ "VpcPrivateSubnet1Subnet536B997A": { "Type": "AWS::EC2::Subnet", "Properties": { - "CidrBlock": "172.168.96.0/19", + "CidrBlock": "10.0.96.0/19", "VpcId": { "Ref": "Vpc8378EB38" }, @@ -402,7 +647,7 @@ "VpcPrivateSubnet2Subnet3788AAA1": { "Type": "AWS::EC2::Subnet", "Properties": { - "CidrBlock": "172.168.128.0/19", + "CidrBlock": "10.0.128.0/19", "VpcId": { "Ref": "Vpc8378EB38" }, @@ -464,7 +709,7 @@ "VpcPrivateSubnet3SubnetF258B56E": { "Type": "AWS::EC2::Subnet", "Properties": { - "CidrBlock": "172.168.160.0/19", + "CidrBlock": "10.0.160.0/19", "VpcId": { "Ref": "Vpc8378EB38" }, @@ -651,251 +896,6 @@ } ] } - }, - "newzone1D011936": { - "Type": "AWS::Route53::HostedZone", - "Properties": { - "Name": "www.test-example.com." - } - }, - "newalbstacknewalbstackalb50B67E3E": { - "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", - "Properties": { - "LoadBalancerAttributes": [ - { - "Key": "deletion_protection.enabled", - "Value": "false" - }, - { - "Key": "access_logs.s3.enabled", - "Value": "true" - }, - { - "Key": "access_logs.s3.bucket", - "Value": { - "Ref": "newalbstackADB02838" - } - }, - { - "Key": "access_logs.s3.prefix", - "Value": "" - } - ], - "Scheme": "internet-facing", - "SecurityGroups": [ - { - "Fn::GetAtt": [ - "newalbstacknewalbstackalbSecurityGroup7BBB827C", - "GroupId" - ] - } - ], - "Subnets": [ - { - "Ref": "VpcPublicSubnet1Subnet5C2D37C4" - }, - { - "Ref": "VpcPublicSubnet2Subnet691E08A3" - }, - { - "Ref": "VpcPublicSubnet3SubnetBE12F0B6" - } - ], - "Type": "application" - }, - "DependsOn": [ - "newalbstackPolicyB7C2D898", - "newalbstackADB02838", - "VpcPublicSubnet1DefaultRoute3DA9E72A", - "VpcPublicSubnet2DefaultRoute97F91067", - "VpcPublicSubnet3DefaultRoute4697774F" - ] - }, - "newalbstacknewalbstackalbSecurityGroup7BBB827C": { - "Type": "AWS::EC2::SecurityGroup", - "Properties": { - "GroupDescription": "Automatically created Security Group for ELB deployPublicApiNewAlbnewalbstacknewalbstackalbC987D9E9", - "SecurityGroupEgress": [ - { - "CidrIp": "255.255.255.255/32", - "Description": "Disallow all traffic", - "FromPort": 252, - "IpProtocol": "icmp", - "ToPort": 86 - } - ], - "VpcId": { - "Ref": "Vpc8378EB38" - } - }, - "DependsOn": [ - "newalbstackPolicyB7C2D898", - "newalbstackADB02838" - ], - "Metadata": { - "cfn_nag": { - "rules_to_suppress": [ - { - "id": "W29", - "reason": "CDK created rule that blocks all traffic." - } - ] - } - } - }, - "newalbstackADB02838": { - "Type": "AWS::S3::Bucket", - "Properties": { - "BucketEncryption": { - "ServerSideEncryptionConfiguration": [ - { - "ServerSideEncryptionByDefault": { - "SSEAlgorithm": "AES256" - } - } - ] - }, - "PublicAccessBlockConfiguration": { - "BlockPublicAcls": true, - "BlockPublicPolicy": true, - "IgnorePublicAcls": true, - "RestrictPublicBuckets": true - }, - "VersioningConfiguration": { - "Status": "Enabled" - } - }, - "UpdateReplacePolicy": "Retain", - "DeletionPolicy": "Retain", - "Metadata": { - "cfn_nag": { - "rules_to_suppress": [ - { - "id": "W35", - "reason": "This is a log bucket for an Application Load Balancer" - } - ] - } - } - }, - "newalbstackPolicyB7C2D898": { - "Type": "AWS::S3::BucketPolicy", - "Properties": { - "Bucket": { - "Ref": "newalbstackADB02838" - }, - "PolicyDocument": { - "Statement": [ - { - "Action": "*", - "Condition": { - "Bool": { - "aws:SecureTransport": "false" - } - }, - "Effect": "Deny", - "Principal": { - "AWS": "*" - }, - "Resource": [ - { - "Fn::Join": [ - "", - [ - { - "Fn::GetAtt": [ - "newalbstackADB02838", - "Arn" - ] - }, - "/*" - ] - ] - }, - { - "Fn::GetAtt": [ - "newalbstackADB02838", - "Arn" - ] - } - ], - "Sid": "HttpsOnly" - }, - { - "Action": [ - "s3:PutObject", - "s3:Abort*" - ], - "Effect": "Allow", - "Principal": { - "AWS": { - "Fn::Join": [ - "", - [ - "arn:", - { - "Ref": "AWS::Partition" - }, - ":iam::127311923021:root" - ] - ] - } - }, - "Resource": { - "Fn::Join": [ - "", - [ - { - "Fn::GetAtt": [ - "newalbstackADB02838", - "Arn" - ] - }, - "/AWSLogs/", - { - "Ref": "AWS::AccountId" - }, - "/*" - ] - ] - } - } - ], - "Version": "2012-10-17" - } - } - }, - "newalbstacknewalbstackalias05E0DF53": { - "Type": "AWS::Route53::RecordSet", - "Properties": { - "Name": "www.test-example.com.", - "Type": "A", - "AliasTarget": { - "DNSName": { - "Fn::Join": [ - "", - [ - "dualstack.", - { - "Fn::GetAtt": [ - "newalbstacknewalbstackalb50B67E3E", - "DNSName" - ] - } - ] - ] - }, - "HostedZoneId": { - "Fn::GetAtt": [ - "newalbstacknewalbstackalb50B67E3E", - "CanonicalHostedZoneID" - ] - } - }, - "HostedZoneId": { - "Ref": "newzone1D011936" - } - } } }, "Parameters": { diff --git a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/route53-alb.test.ts b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/route53-alb.test.ts index f319df513..2698936e9 100644 --- a/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/route53-alb.test.ts +++ b/source/patterns/@aws-solutions-constructs/aws-route53-alb/test/route53-alb.test.ts @@ -104,6 +104,38 @@ test('Test Private API, existing VPC', () => { }); +test('Test Private API, new VPC', () => { + // Initial Setup + const stack = new Stack(undefined, undefined, { + env: { account: "123456789012", region: 'us-east-1' }, + }); + + const props: Route53ToAlbProps = { + publicApi: false, + privateHostedZoneProps: { + zoneName: 'www.example-test.com', + } + }; + + new Route53ToAlb(stack, 'test-route53-alb', props); + + expect(stack).toHaveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', { + Scheme: 'internal' + }); + + expect(stack).toHaveResourceLike('AWS::EC2::VPC', { + EnableDnsHostnames: true, + EnableDnsSupport: true, + InstanceTenancy: "default", + }); + + expect(stack).toHaveResourceLike('AWS::Route53::RecordSet', { + Name: 'www.example-test.com.', + Type: 'A' + }); + +}); + test('Check publicApi and zone props is an error', () => { // Initial Setup const stack = new Stack(); diff --git a/source/patterns/@aws-solutions-constructs/core/lib/alb-helper.ts b/source/patterns/@aws-solutions-constructs/core/lib/alb-helper.ts index 7ac21d40c..7034fbfba 100644 --- a/source/patterns/@aws-solutions-constructs/core/lib/alb-helper.ts +++ b/source/patterns/@aws-solutions-constructs/core/lib/alb-helper.ts @@ -121,7 +121,7 @@ export function AddListener( export function CreateLambdaTargetGroup( scope: Construct, id: string, - lambdaFunction: lambda.Function, + lambdaFunction: lambda.IFunction, targetProps?: elb.ApplicationTargetGroupProps ): elb.ApplicationTargetGroup { const lambdaTarget = new elbt.LambdaTarget(lambdaFunction); From b8af2559e88839ec236c259a287ac9ad695d5312 Mon Sep 17 00:00:00 2001 From: biffgaut <78155736+biffgaut@users.noreply.github.com> Date: Wed, 13 Oct 2021 16:45:56 -0400 Subject: [PATCH 14/14] viperlight edits --- .viperlightignore | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.viperlightignore b/.viperlightignore index 9a7c8cc93..6604c2705 100644 --- a/.viperlightignore +++ b/.viperlightignore @@ -144,4 +144,4 @@ source/patterns/@aws-solutions-constructs/aws-lambda-eventbridge/test/aws-lambda # These are references to the us-east-1 ELBV2 account (publicly known) source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApi.expected.json:193 source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPrivateApiExistingZone.expected.json:844 -source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json:839 +source/patterns/@aws-solutions-constructs/aws-route53-alb/test/integ.deployPublicApiNewAlb.expected.json:188