Skip to content

Commit e8b8444

Browse files
elthrasherelthrasher
committed
stackset changes and hosted zone cdk stacks
1 parent 8cbf946 commit e8b8444

18 files changed

+3232
-5
lines changed

‎.eslintignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
cdk.out

‎.eslintrc.cjs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
module.exports = {
2+
env: { node: true },
3+
extends: ['eslint:recommended', 'plugin:@typescript-eslint/recommended', 'plugin:prettier/recommended'],
4+
parser: '@typescript-eslint/parser',
5+
plugins: ['@typescript-eslint'],
6+
root: true,
7+
};

‎.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,6 @@
11
.vscode
22
.DS_Store
3+
node_modules
4+
5+
cdk.out
6+
coverage

‎.prettierrc.cjs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
module.exports = {
2+
semi: true,
3+
trailingComma: 'all',
4+
singleQuote: true,
5+
printWidth: 120,
6+
tabWidth: 2,
7+
};

‎StackSets/README.md

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
```
88

99
```bash
10-
% aws cloudformation create-stack-instances --stack-set-name required-tags --deployment-targets OrganizationalUnitIds=ou-o1po-8t2jlg7y,ou-o1po-nc0nerid,ou-o1po-ei9sq3nv --regions eu-west-1 --operation-preferences FailureToleranceCount=0,MaxConcurrentCount=1
10+
% aws cloudformation create-stack-instances --stack-set-name required-tags --deployment-targets OrganizationalUnitIds=ou-o1po-8t2jlg7y,ou-o1po-nc0nerid,ou-o1po-ei9sq3nv,ou-o1po-gc7tz6ee --regions eu-west-1 us-east-1
1111
```
1212

1313
## PermissionsBoundary StackSet
@@ -17,7 +17,7 @@
1717
```
1818

1919
```bash
20-
% aws cloudformation create-stack-instances --stack-set-name permissions-boundary --deployment-targets OrganizationalUnitIds=ou-o1po-8t2jlg7y,ou-o1po-nc0nerid,ou-o1po-ei9sq3nv,Accounts=353228500194 --regions eu-west-1 --operation-preferences FailureToleranceCount=0,MaxConcurrentCount=1
20+
% aws cloudformation create-stack-instances --stack-set-name permissions-boundary --deployment-targets OrganizationalUnitIds=ou-o1po-8t2jlg7y,ou-o1po-nc0nerid,ou-o1po-ei9sq3nv,ou-o1po-gc7tz6ee --regions eu-west-1
2121
```
2222

2323
```bash
@@ -27,9 +27,13 @@ aws cloudformation create-stack --stack-name permissions-boundary --template-bod
2727
## CDK Bootstrap StackSet
2828

2929
```bash
30-
% aws cloudformation create-stack-set --stack-set-name cdk-bootstrap --template-body file://./StackSets/CdkBootstrap.yml --region eu-west-1 --tags Key=acb:cost-allocation:env,Value=org Key=acb:cost-allocation:owner,[email protected] Key=acb:cost-allocation:provider,Value=CloudFormation Key=acb:cost-allocation:service,Value=organization --permission-model SERVICE_MANAGED --auto-deployment Enabled=true,RetainStacksOnAccountRemoval=false --capabilities CAPABILITY_NAMED_IAM --parameters ParameterKey=InputPermissionsBoundary,ParameterValue=developer-policy
30+
% aws cloudformation create-stack-set --stack-set-name cdk-bootstrap --template-body file://./StackSets/CdkBootstrap.yml --region eu-west-1 --tags Key=acb:cost-allocation:env,Value=org Key=acb:cost-allocation:owner,[email protected] Key=acb:cost-allocation:provider,Value=CloudFormation Key=acb:cost-allocation:service,Value=organization --permission-model SERVICE_MANAGED --auto-deployment Enabled=true,RetainStacksOnAccountRemoval=false --capabilities CAPABILITY_NAMED_IAM --parameters ParameterKey=InputPermissionsBoundary,ParameterValue=developer-policy ParameterKey=TrustedAccounts,ParameterValue=447002520154 ParameterKey=CloudFormationExecutionPolicies,ParameterValue=arn:aws:iam::aws:policy/AdministratorAccess
3131
```
3232

3333
```bash
34-
% aws cloudformation create-stack-instances --stack-set-name cdk-bootstrap --deployment-targets OrganizationalUnitIds=ou-o1po-8t2jlg7y,ou-o1po-nc0nerid,ou-o1po-ei9sq3nv --regions eu-west-1 --operation-preferences FailureToleranceCount=0,MaxConcurrentCount=1
35-
```
34+
% aws cloudformation create-stack-instances --stack-set-name cdk-bootstrap --deployment-targets OrganizationalUnitIds=ou-o1po-8t2jlg7y,ou-o1po-nc0nerid,ou-o1po-ei9sq3nv,ou-o1po-gc7tz6ee --regions eu-west-1 us-east-1
35+
```
36+
37+
```bash
38+
% aws cloudformation create-stack --stack-name cdk-bootstrap --template-body file://./StackSets/CdkBootstrap.yml --region eu-west-1 --tags Key=acb:cost-allocation:env,Value=org Key=acb:cost-allocation:owner,[email protected] Key=acb:cost-allocation:provider,Value=CloudFormation Key=acb:cost-allocation:service,Value=organization --capabilities CAPABILITY_NAMED_IAM --parameters ParameterKey=InputPermissionsBoundary,ParameterValue=developer-policy
39+
```

‎cdk.json

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"app": "npx ts-node --prefer-ts-exts cdk/aws-organization-for-devs.ts",
3+
"watch": {
4+
"include": [
5+
"**"
6+
],
7+
"exclude": [
8+
"README.md",
9+
"cdk*.json",
10+
"**/*.d.ts",
11+
"**/*.js",
12+
"tsconfig.json",
13+
"package*.json",
14+
"yarn.lock",
15+
"node_modules",
16+
"test"
17+
]
18+
},
19+
"context": {
20+
"@aws-cdk/aws-lambda:recognizeLayerVersion": true,
21+
"@aws-cdk/core:checkSecretUsage": true,
22+
"@aws-cdk/core:target-partitions": [
23+
"aws",
24+
"aws-cn"
25+
],
26+
"@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver": true,
27+
"@aws-cdk/aws-ec2:uniqueImdsv2TemplateName": true,
28+
"@aws-cdk/aws-ecs:arnFormatIncludesClusterName": true,
29+
"@aws-cdk/aws-iam:minimizePolicies": true,
30+
"@aws-cdk/core:validateSnapshotRemovalPolicy": true,
31+
"@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName": true,
32+
"@aws-cdk/aws-s3:createDefaultLoggingPolicy": true,
33+
"@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption": true,
34+
"@aws-cdk/aws-apigateway:disableCloudWatchRole": true,
35+
"@aws-cdk/core:enablePartitionLiterals": true,
36+
"@aws-cdk/aws-events:eventsTargetQueueSameAccount": true,
37+
"@aws-cdk/aws-iam:standardizedServicePrincipals": true,
38+
"@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker": true,
39+
"@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName": true,
40+
"@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy": true,
41+
"@aws-cdk/aws-route53-patters:useCertificate": true,
42+
"@aws-cdk/customresources:installLatestAwsSdkDefault": false,
43+
"@aws-cdk/aws-rds:databaseProxyUniqueResourceName": true,
44+
"@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup": true,
45+
"@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId": true,
46+
"@aws-cdk/aws-ec2:launchTemplateDefaultUserData": true,
47+
"@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments": true,
48+
"@aws-cdk/aws-redshift:columnId": true,
49+
"@aws-cdk/core:permissionsBoundary": {
50+
"name": "developer-policy"
51+
}
52+
}
53+
}

‎cdk/README.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# CDK Stacks
2+
3+
## Hosted Zone Stack
4+
5+
Creates the root hosted zone for awscommunitybuilders.org and a delegation role that will allow stacks in other accounts to create subdomains.
6+
7+
## Delegated Zone Stack
8+
9+
Creates an environment-specific subdomain and a wildcard certificate for that subdomain. The certificate arn is stored in Secrets Manager (and not Parameter Store because of region replication) so that other stacks can apply the arn to Cloudfront Distributions.

‎cdk/__snapshots__/delegated-zone-stack.spec.ts.snap

Lines changed: 240 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,240 @@
1+
// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
2+
3+
exports[`Entire Stack > match a snapshot 1`] = `
4+
{
5+
"Outputs": {
6+
"certArn": {
7+
"Description": "certificate arn",
8+
"Value": {
9+
"Ref": "DelegatedZoneCert71201BFD",
10+
},
11+
},
12+
"nameservers": {
13+
"Description": "nameservers",
14+
"Value": {
15+
"Fn::Join": [
16+
", ",
17+
{
18+
"Fn::GetAtt": [
19+
"delegatedZone93B2A299",
20+
"NameServers",
21+
],
22+
},
23+
],
24+
},
25+
},
26+
},
27+
"Parameters": {
28+
"BootstrapVersion": {
29+
"Default": "/cdk-bootstrap/hnb659fds/version",
30+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]",
31+
"Type": "AWS::SSM::Parameter::Value<String>",
32+
},
33+
},
34+
"Resources": {
35+
"AccountCerteArn7BFDEF53": {
36+
"DeletionPolicy": "Delete",
37+
"Properties": {
38+
"Name": "/account/certificateArn",
39+
"ReplicaRegions": [
40+
{
41+
"Region": "eu-west-1",
42+
},
43+
],
44+
"SecretString": {
45+
"Ref": "DelegatedZoneCert71201BFD",
46+
},
47+
},
48+
"Type": "AWS::SecretsManager::Secret",
49+
"UpdateReplacePolicy": "Delete",
50+
},
51+
"CustomCrossAccountZoneDelegationCustomResourceProviderHandler44A84265": {
52+
"DependsOn": [
53+
"CustomCrossAccountZoneDelegationCustomResourceProviderRoleED64687B",
54+
],
55+
"Properties": {
56+
"Code": {"S3Bucket":{"Fn::Sub":"cdk-hnb659fds-assets-\${AWS::AccountId}-\${AWS::Region}"},"S3Key":"[HASH REMOVED].zip"},
57+
"Handler": "__entrypoint__.handler",
58+
"MemorySize": 128,
59+
"Role": {
60+
"Fn::GetAtt": [
61+
"CustomCrossAccountZoneDelegationCustomResourceProviderRoleED64687B",
62+
"Arn",
63+
],
64+
},
65+
"Runtime": "nodejs14.x",
66+
"Timeout": 900,
67+
},
68+
"Type": "AWS::Lambda::Function",
69+
},
70+
"CustomCrossAccountZoneDelegationCustomResourceProviderRoleED64687B": {
71+
"Properties": {
72+
"AssumeRolePolicyDocument": {
73+
"Statement": [
74+
{
75+
"Action": "sts:AssumeRole",
76+
"Effect": "Allow",
77+
"Principal": {
78+
"Service": "lambda.amazonaws.com",
79+
},
80+
},
81+
],
82+
"Version": "2012-10-17",
83+
},
84+
"ManagedPolicyArns": [
85+
{
86+
"Fn::Sub": "arn:\${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
87+
},
88+
],
89+
},
90+
"Type": "AWS::IAM::Role",
91+
},
92+
"DelegatedZoneCert71201BFD": {
93+
"Properties": {
94+
"DomainName": "*.sandbox.awscommunitybuilders.org",
95+
"DomainValidationOptions": [
96+
{
97+
"DomainName": "*.sandbox.awscommunitybuilders.org",
98+
"HostedZoneId": {
99+
"Ref": "delegatedZone93B2A299",
100+
},
101+
},
102+
],
103+
"Tags": [
104+
{
105+
"Key": "Name",
106+
"Value": "test-stack/DelegatedZoneCert",
107+
},
108+
],
109+
"ValidationMethod": "DNS",
110+
},
111+
"Type": "AWS::CertificateManager::Certificate",
112+
},
113+
"DelegationRecordCrossAccountZoneDelegationCustomResource3FB1AD46": {
114+
"DeletionPolicy": "Delete",
115+
"DependsOn": [
116+
"DelegationRecordcrossaccountzonedelegationhandlerrolePolicy7B31DBF8",
117+
],
118+
"Properties": {
119+
"AssumeRoleArn": {
120+
"Fn::Join": [
121+
"",
122+
[
123+
"arn:",
124+
{
125+
"Ref": "AWS::Partition",
126+
},
127+
":iam::353228500194:role/HostedZoneDelegationRole",
128+
],
129+
],
130+
},
131+
"DelegatedZoneName": "sandbox.awscommunitybuilders.org",
132+
"DelegatedZoneNameServers": {
133+
"Fn::GetAtt": [
134+
"delegatedZone93B2A299",
135+
"NameServers",
136+
],
137+
},
138+
"ParentZoneName": "awscommunitybuilders.org",
139+
"ServiceToken": {
140+
"Fn::GetAtt": [
141+
"CustomCrossAccountZoneDelegationCustomResourceProviderHandler44A84265",
142+
"Arn",
143+
],
144+
},
145+
"TTL": 172800,
146+
},
147+
"Type": "Custom::CrossAccountZoneDelegation",
148+
"UpdateReplacePolicy": "Delete",
149+
},
150+
"DelegationRecordcrossaccountzonedelegationhandlerrolePolicy7B31DBF8": {
151+
"Properties": {
152+
"PolicyDocument": {
153+
"Statement": [
154+
{
155+
"Action": "sts:AssumeRole",
156+
"Effect": "Allow",
157+
"Resource": {
158+
"Fn::Join": [
159+
"",
160+
[
161+
"arn:",
162+
{
163+
"Ref": "AWS::Partition",
164+
},
165+
":iam::353228500194:role/HostedZoneDelegationRole",
166+
],
167+
],
168+
},
169+
},
170+
],
171+
"Version": "2012-10-17",
172+
},
173+
"PolicyName": "DelegationRecordcrossaccountzonedelegationhandlerrolePolicy7B31DBF8",
174+
"Roles": [
175+
{
176+
"Fn::Select": [
177+
1,
178+
{
179+
"Fn::Split": [
180+
"/",
181+
{
182+
"Fn::Select": [
183+
5,
184+
{
185+
"Fn::Split": [
186+
":",
187+
{
188+
"Fn::GetAtt": [
189+
"CustomCrossAccountZoneDelegationCustomResourceProviderRoleED64687B",
190+
"Arn",
191+
],
192+
},
193+
],
194+
},
195+
],
196+
},
197+
],
198+
},
199+
],
200+
},
201+
],
202+
},
203+
"Type": "AWS::IAM::Policy",
204+
},
205+
"delegatedZone93B2A299": {
206+
"Properties": {
207+
"Name": "sandbox.awscommunitybuilders.org.",
208+
},
209+
"Type": "AWS::Route53::HostedZone",
210+
},
211+
},
212+
"Rules": {
213+
"CheckBootstrapVersion": {
214+
"Assertions": [
215+
{
216+
"Assert": {
217+
"Fn::Not": [
218+
{
219+
"Fn::Contains": [
220+
[
221+
"1",
222+
"2",
223+
"3",
224+
"4",
225+
"5",
226+
],
227+
{
228+
"Ref": "BootstrapVersion",
229+
},
230+
],
231+
},
232+
],
233+
},
234+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI.",
235+
},
236+
],
237+
},
238+
},
239+
}
240+
`;

0 commit comments

Comments
 (0)