-
Notifications
You must be signed in to change notification settings - Fork 249
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(aws-fargate-secretsmanager): Create new construct #670
Merged
Merged
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
4 changes: 4 additions & 0 deletions
4
source/patterns/@aws-solutions-constructs/aws-fargate-secretsmanager/.eslintignore
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,4 @@ | ||
lib/*.js | ||
test/*.js | ||
*.d.ts | ||
coverage |
15 changes: 15 additions & 0 deletions
15
source/patterns/@aws-solutions-constructs/aws-fargate-secretsmanager/.gitignore
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,15 @@ | ||
lib/*.js | ||
test/*.js | ||
*.js.map | ||
*.d.ts | ||
node_modules | ||
*.generated.ts | ||
dist | ||
.jsii | ||
|
||
.LAST_BUILD | ||
.nyc_output | ||
coverage | ||
.nycrc | ||
.LAST_PACKAGE | ||
*.snk |
21 changes: 21 additions & 0 deletions
21
source/patterns/@aws-solutions-constructs/aws-fargate-secretsmanager/.npmignore
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,21 @@ | ||
# Exclude typescript source and config | ||
*.ts | ||
tsconfig.json | ||
coverage | ||
.nyc_output | ||
*.tgz | ||
*.snk | ||
*.tsbuildinfo | ||
|
||
# Include javascript files and typescript declarations | ||
!*.js | ||
!*.d.ts | ||
|
||
# Exclude jsii outdir | ||
dist | ||
|
||
# Include .jsii | ||
!.jsii | ||
|
||
# Include .jsii | ||
!.jsii |
120 changes: 120 additions & 0 deletions
120
source/patterns/@aws-solutions-constructs/aws-fargate-secretsmanager/README.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,120 @@ | ||
# aws-fargate-secretsmanager module | ||
<!--BEGIN STABILITY BANNER--> | ||
|
||
--- | ||
|
||
![Stability: Experimental](https://img.shields.io/badge/stability-Experimental-important.svg?style=for-the-badge) | ||
|
||
> All classes are under active development and subject to non-backward compatible changes or removal in any | ||
> future version. These are not subject to the [Semantic Versioning](https://semver.org/) model. | ||
> This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package. | ||
|
||
--- | ||
<!--END STABILITY BANNER--> | ||
|
||
| **Reference Documentation**:| <span style="font-weight: normal">https://docs.aws.amazon.com/solutions/latest/constructs/</span>| | ||
|:-------------|:-------------| | ||
<div style="height:8px"></div> | ||
|
||
| **Language** | **Package** | | ||
|:-------------|-----------------| | ||
|![Python Logo](https://docs.aws.amazon.com/cdk/api/latest/img/python32.png) Python|`aws_solutions_constructs.aws_fargate_secretsmanager`| | ||
|![Typescript Logo](https://docs.aws.amazon.com/cdk/api/latest/img/typescript32.png) Typescript|`@aws-solutions-constructs/aws-fargate-secretsmanager`| | ||
|![Java Logo](https://docs.aws.amazon.com/cdk/api/latest/img/java32.png) Java|`software.amazon.awsconstructs.services.fargatesecretsmanager`| | ||
|
||
This AWS Solutions Construct implements an AWS Fargate service that can write/read to an AWS Secrets Manager | ||
|
||
Here is a minimal deployable pattern definition: | ||
|
||
Typescript | ||
``` typescript | ||
import { Construct } from 'constructs'; | ||
import { Stack, StackProps } from 'aws-cdk-lib'; | ||
import { FargateToSecretsmanager, FargateToSecretsmanagerProps } from '@aws-solutions-constructs/aws-fargate-secretsmanager'; | ||
|
||
const constructProps: FargateToSecretsmanagerProps = { | ||
publicApi: true, | ||
ecrRepositoryArn: "arn:aws:ecr:us-east-1:123456789012:repository/your-ecr-repo", | ||
}; | ||
|
||
new FargateToSecretsmanager(stack, 'test-construct', constructProps); | ||
``` | ||
|
||
Python | ||
``` python | ||
from aws_solutions_constructs.aws_fargate_secretsmanager import FargateToSecretsmanager, FargateToSecretsmanagerProps | ||
from aws_cdk import ( | ||
Stack | ||
) | ||
from constructs import Construct | ||
|
||
FargateToSecretsmanager(self, 'test_construct', | ||
public_api=True, | ||
ecr_repository_arn="arn:aws:ecr:us-east-1:123456789012:repository/your-ecr-repo") | ||
``` | ||
|
||
Java | ||
``` java | ||
import software.constructs.Construct; | ||
|
||
import software.amazon.awscdk.Stack; | ||
import software.amazon.awscdk.StackProps; | ||
import software.amazon.awsconstructs.services.fargatesecretsmanager.*; | ||
|
||
new FargateToSecretsmanager(this, "test-construct", new FargateToSecretsmanagerProps.Builder() | ||
.publicApi(true) | ||
.ecrRepositoryArn("arn:aws:ecr:us-east-1:123456789012:repository/your-ecr-repo") | ||
.build()); | ||
``` | ||
|
||
## Pattern Construct Props | ||
|
||
| **Name** | **Type** | **Description** | | ||
|:-------------|:----------------|-----------------| | ||
| publicApi | `boolean` | Whether the construct is deploying a private or public API. This has implications for the VPC. | | ||
| vpcProps? | [`ec2.VpcProps`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-ec2.VpcProps.html) | Optional custom properties for a VPC the construct will create. This VPC will be used by any Private Hosted Zone the construct creates (that's why loadBalancerProps and privateHostedZoneProps can't include a VPC). Providing both this and existingVpc is an error. | | ||
| existingVpc? | [`ec2.IVpc`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-ec2.IVpc.html) | An existing VPC in which to deploy the construct. Providing both this and vpcProps is an error. If the client provides an existing load balancer and/or existing Private Hosted Zone, those constructs must exist in this VPC. | | ||
| clusterProps? | [`ecs.ClusterProps`](https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-ecs.ClusterProps.html) | Optional properties to create a new ECS cluster. To provide an existing cluster, use the cluster attribute of fargateServiceProps. | | ||
| ecrRepositoryArn? | `string` | The arn of an ECR Repository containing the image to use to generate the containers. Either this or the image property of containerDefinitionProps must be provided. format: arn:aws:ecr:*region*:*account number*:repository/*Repository Name* | | ||
| ecrImageVersion? | `string` | The version of the image to use from the repository. Defaults to 'Latest' | | ||
| containerDefinitionProps? | [`ecs.ContainerDefinitionProps \| any`](https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-ecs.ContainerDefinitionProps.html) | Optional props to define the container created for the Fargate Service (defaults found in fargate-defaults.ts) | | ||
| fargateTaskDefinitionProps? | [`ecs.FargateTaskDefinitionProps \| any`](https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-ecs.FargateTaskDefinitionProps.html) | Optional props to define the Fargate Task Definition for this construct (defaults found in fargate-defaults.ts) | | ||
| fargateServiceProps? | [`ecs.FargateServiceProps \| any`](https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-ecs.FargateServiceProps.html) | Optional values to override default Fargate Task definition properties (fargate-defaults.ts). The construct will default to launching the service is the most isolated subnets available (precedence: Isolated, Private and Public). Override those and other defaults here. | | ||
| existingFargateServiceObject? | [`ecs.FargateService`](https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-ecs.FargateService.html) | A Fargate Service already instantiated (probably by another Solutions Construct). If this is specified, then no props defining a new service can be provided, including: ecrImageVersion, containerDefinitionProps, fargateTaskDefinitionProps, ecrRepositoryArn, fargateServiceProps, clusterProps | | ||
| existingContainerDefinitionObject? | [`ecs.ContainerDefinition`](https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-ecs.ContainerDefinition.html) | A container definition already instantiated as part of a Fargate service. This must be the container in the existingFargateServiceObject | | ||
|secretProps?|[`secretsmanager.SecretProps`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-secretsmanager.SecretProps.html)|Optional user provided props to override the default props for Secrets Manager| | ||
|existingSecretObj?|[`secretsmanager.Secret`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-secretsmanager.Secret.html)|Existing instance of Secrets Manager Secret object, If this is set then the secretProps is ignored| | ||
|grantWriteAccess?|`boolean`|Optional write access to the Secret for the Fargate service (Read-Only by default) | ||
|secretEnvironmentVariableName?|`string`|Optional Name for the Secrets Manager secret environment variable set for the Fargate service.| | ||
|
||
## Pattern Properties | ||
|
||
| **Name** | **Type** | **Description** | | ||
|:-------------|:----------------|-----------------| | ||
| vpc | [`ec2.IVpc`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-ec2.IVpc.html) | The VPC used by the construct (whether created by the construct or provided by the client) | | ||
| service | [`ecs.FargateService`](https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-ecs.FargateService.html) | The AWS Fargate service used by this construct (whether created by this construct or passed to this construct at initialization) | | ||
| container | [`ecs.ContainerDefinition`](https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-ecs.ContainerDefinition.html) | The container associated with the AWS Fargate service in the service property. | | ||
|secret|[`secretsmanager.Secret`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-secretsmanager.Secret.html)|Returns an instance of `secretsmanager.Secret` created by the construct| | ||
|
||
## Default settings | ||
|
||
Out of the box implementation of the Construct without any override will set the following defaults: | ||
|
||
### AWS Fargate Service | ||
* Sets up an AWS Fargate service | ||
* Uses the existing service if provided | ||
* Creates a new service if none provided. | ||
* Service will run in isolated subnets if available, then private subnets if available and finally public subnets | ||
* Adds environment variables to the container with the ARN and Name of the Secrets Manager secret | ||
* Add permissions to the container IAM role allowing it to publish to the Secrets Manager secret | ||
|
||
### Amazon Secrets Manager Secret | ||
* Sets up an Amazon Secrets Manager secret | ||
* Uses an existing secret if one is provided, otherwise creates a new one | ||
* Adds an Interface Endpoint to the VPC for Secrets Manager (the service by default runs in Isolated or Private subnets) | ||
|
||
## Architecture | ||
![Architecture Diagram](architecture.png) | ||
|
||
*** | ||
© Copyright 2022 Amazon.com, Inc. or its affiliates. All Rights Reserved. |
Binary file added
BIN
+125 KB
.../patterns/@aws-solutions-constructs/aws-fargate-secretsmanager/architecture.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
197 changes: 197 additions & 0 deletions
197
source/patterns/@aws-solutions-constructs/aws-fargate-secretsmanager/lib/index.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,197 @@ | ||
/** | ||
* Copyright 2022 Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
* | ||
* Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance | ||
* with the License. A copy of the License is located at | ||
* | ||
* http://www.apache.org/licenses/LICENSE-2.0 | ||
* | ||
* or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES | ||
* OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions | ||
* and limitations under the License. | ||
*/ | ||
|
||
import * as ec2 from "@aws-cdk/aws-ec2"; | ||
import * as secretsmanager from "@aws-cdk/aws-secretsmanager"; | ||
// Note: To ensure CDKv2 compatibility, keep the import statement for Construct separate | ||
import { Construct } from "@aws-cdk/core"; | ||
import * as defaults from "@aws-solutions-constructs/core"; | ||
import * as ecs from "@aws-cdk/aws-ecs"; | ||
|
||
export interface FargateToSecretsmanagerProps { | ||
/** | ||
* Whether the construct is deploying a private or public API. This has implications for the VPC deployed | ||
* by this construct. | ||
* | ||
* @default - none | ||
*/ | ||
readonly publicApi: boolean; | ||
/** | ||
* Optional custom properties for a VPC the construct will create. This VPC will | ||
* be used by the new Fargate service the construct creates (that's | ||
* why targetGroupProps can't include a VPC). Providing | ||
* both this and existingVpc is an error. An Secrets Manager Interface | ||
mickychetta marked this conversation as resolved.
Show resolved
Hide resolved
|
||
* endpoint will be included in this VPC. | ||
* | ||
* @default - none | ||
*/ | ||
readonly vpcProps?: ec2.VpcProps; | ||
/** | ||
* An existing VPC in which to deploy the construct. Providing both this and | ||
* vpcProps is an error. If the client provides an existing Fargate service, | ||
* this value must be the VPC where the service is running. An Secrets Manager Interface | ||
mickychetta marked this conversation as resolved.
Show resolved
Hide resolved
|
||
* endpoint will be added to this VPC. | ||
* | ||
* @default - none | ||
*/ | ||
readonly existingVpc?: ec2.IVpc; | ||
/** | ||
* Optional properties to create a new ECS cluster | ||
*/ | ||
readonly clusterProps?: ecs.ClusterProps; | ||
/** | ||
* The arn of an ECR Repository containing the image to use | ||
* to generate the containers | ||
* | ||
* format: | ||
* arn:aws:ecr:[region]:[account number]:repository/[Repository Name] | ||
*/ | ||
readonly ecrRepositoryArn?: string; | ||
/** | ||
* The version of the image to use from the repository | ||
* | ||
* @default - 'latest' | ||
*/ | ||
readonly ecrImageVersion?: string; | ||
/* | ||
* Optional props to define the container created for the Fargate Service | ||
* | ||
* defaults - fargate-defaults.ts | ||
*/ | ||
readonly containerDefinitionProps?: ecs.ContainerDefinitionProps | any; | ||
/* | ||
* Optional props to define the Fargate Task Definition for this construct | ||
* | ||
* defaults - fargate-defaults.ts | ||
*/ | ||
readonly fargateTaskDefinitionProps?: ecs.FargateTaskDefinitionProps | any; | ||
/** | ||
* Optional values to override default Fargate Task definition properties | ||
* (fargate-defaults.ts). The construct will default to launching the service | ||
* is the most isolated subnets available (precedence: Isolated, Private and | ||
* Public). Override those and other defaults here. | ||
* | ||
* defaults - fargate-defaults.ts | ||
*/ | ||
readonly fargateServiceProps?: ecs.FargateServiceProps | any; | ||
/** | ||
* A Fargate Service already instantiated (probably by another Solutions Construct). If | ||
* this is specified, then no props defining a new service can be provided, including: | ||
* existingImageObject, ecrImageVersion, containerDefintionProps, fargateTaskDefinitionProps, | ||
* ecrRepositoryArn, fargateServiceProps, clusterProps, existingClusterInterface. If this value | ||
* is provided, then existingContainerDefinitionObject must be provided as well. | ||
* | ||
* @default - none | ||
*/ | ||
readonly existingFargateServiceObject?: ecs.FargateService; | ||
/* | ||
* A container definition already instantiated as part of a Fargate service. This must | ||
* be the container in the existingFargateServiceObject. | ||
* | ||
* @default - None | ||
*/ | ||
readonly existingContainerDefinitionObject?: ecs.ContainerDefinition; | ||
/** | ||
* Existing instance of Secret object, providing both this and secretProps will cause an error. | ||
* | ||
* @default - Default props are used | ||
*/ | ||
readonly existingSecretObj?: secretsmanager.Secret; | ||
/** | ||
* Optional user-provided props to override the default props for the Secret. | ||
* | ||
* @default - Default props are used | ||
*/ | ||
readonly secretProps?: secretsmanager.SecretProps; | ||
|
||
/** | ||
* Optional Access granted to the Fargate service for the secret. 'Read' or 'ReadWrite | ||
* | ||
* @default - 'Read' | ||
*/ | ||
readonly grantWriteAccess?: string | ||
/** | ||
* Optional Name for container environment variable containing the ARN of the secret. | ||
* | ||
* @default - SECRET_ARN | ||
*/ | ||
readonly secretEnvironmentVariableName?: string; | ||
} | ||
|
||
export class FargateToSecretsmanager extends Construct { | ||
public readonly vpc: ec2.IVpc; | ||
public readonly service: ecs.FargateService; | ||
public readonly container: ecs.ContainerDefinition; | ||
public readonly secret: secretsmanager.Secret; | ||
|
||
constructor(scope: Construct, id: string, props: FargateToSecretsmanagerProps) { | ||
super(scope, id); | ||
defaults.CheckProps(props); | ||
defaults.CheckFargateProps(props); | ||
|
||
// Other permissions for constructs are accepted as arrays, turning grantWriteAccess into | ||
// an array to use the same validation function. | ||
if (props.grantWriteAccess) { | ||
const allowedPermissions = ['READ', 'READWRITE']; | ||
defaults.CheckListValues(allowedPermissions, [props.grantWriteAccess.toUpperCase()], 'grantWriteAccess'); | ||
} | ||
|
||
this.vpc = defaults.buildVpc(scope, { | ||
existingVpc: props.existingVpc, | ||
defaultVpcProps: props.publicApi ? defaults.DefaultPublicPrivateVpcProps() : defaults.DefaultIsolatedVpcProps(), | ||
userVpcProps: props.vpcProps, | ||
constructVpcProps: { enableDnsHostnames: true, enableDnsSupport: true } | ||
}); | ||
|
||
defaults.AddAwsServiceEndpoint(scope, this.vpc, defaults.ServiceEndpointTypes.SECRETS_MANAGER); | ||
|
||
if (props.existingFargateServiceObject) { | ||
this.service = props.existingFargateServiceObject; | ||
// CheckFargateProps confirms that the container is provided | ||
this.container = props.existingContainerDefinitionObject!; | ||
} else { | ||
[this.service, this.container] = defaults.CreateFargateService( | ||
scope, | ||
id, | ||
this.vpc, | ||
props.clusterProps, | ||
props.ecrRepositoryArn, | ||
props.ecrImageVersion, | ||
props.fargateTaskDefinitionProps, | ||
props.containerDefinitionProps, | ||
props.fargateServiceProps | ||
); | ||
} | ||
|
||
if (props.existingSecretObj) { | ||
this.secret = props.existingSecretObj; | ||
} else { | ||
this.secret = defaults.buildSecretsManagerSecret(this, 'secret', props.secretProps); | ||
} | ||
|
||
// Enable read permissions for the Fargate service role by default | ||
this.secret.grantRead(this.service.taskDefinition.taskRole); | ||
|
||
if (props.grantWriteAccess) { | ||
const permission = props.grantWriteAccess.toUpperCase(); | ||
|
||
if (permission === 'READWRITE') { | ||
this.secret.grantWrite(this.service.taskDefinition.taskRole); | ||
} | ||
} | ||
|
||
// Configure environment variables | ||
const secretEnvironmentVariableName = props.secretEnvironmentVariableName || 'SECRET_ARN'; | ||
this.container.addEnvironment(secretEnvironmentVariableName, this.secret.secretArn); | ||
} | ||
} |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Compare these with aws-lambda-secretmanager
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
KMS comment does not add value