-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
5fb3070
commit 6c3b9d7
Showing
16 changed files
with
4,626 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,34 @@ | ||
name: Deploy CDK Stack | ||
on: | ||
push: | ||
branches: | ||
- cdk | ||
jobs: | ||
deploy: | ||
runs-on: ubuntu-latest | ||
permissions: | ||
actions: write | ||
contents: read | ||
id-token: write | ||
steps: | ||
- uses: actions/checkout@v4 | ||
- name: Setup Node.js | ||
uses: actions/setup-node@v3 | ||
with: | ||
node-version: '18' | ||
cache: 'npm' | ||
cache-dependency-path: test-app | ||
- name: Install CDK | ||
run: npm install -g aws-cdk | ||
- name: Install dependencies | ||
working-directory: test-app | ||
run: npm install | ||
- uses: aws-actions/configure-aws-credentials@v4 | ||
with: | ||
aws-region: ap-southeast-2 | ||
role-to-assume: arn:aws:iam::854640616043:role/GitHubStack-deployroleC69923DD-BV0NXT8YQN38 | ||
role-duration-seconds: 900 | ||
output-credentials: true | ||
- name: Deploy CDK Stack | ||
working-directory: test-app | ||
run: cdk deploy TestAppStack |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,8 @@ | ||
*.js | ||
!jest.config.js | ||
*.d.ts | ||
node_modules | ||
|
||
# CDK asset staging directory | ||
.cdk.staging | ||
cdk.out |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
*.ts | ||
!*.d.ts | ||
|
||
# CDK asset staging directory | ||
.cdk.staging | ||
cdk.out |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,14 @@ | ||
# Welcome to your CDK TypeScript project | ||
|
||
This is a blank project for CDK development with TypeScript. | ||
|
||
The `cdk.json` file tells the CDK Toolkit how to execute your app. | ||
|
||
## Useful commands | ||
|
||
* `npm run build` compile typescript to js | ||
* `npm run watch` watch for changes and compile | ||
* `npm run test` perform the jest unit tests | ||
* `cdk deploy` deploy this stack to your default AWS account/region | ||
* `cdk diff` compare deployed stack with current state | ||
* `cdk synth` emits the synthesized CloudFormation template |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,18 @@ | ||
#!/usr/bin/env node | ||
import "source-map-support/register"; | ||
import * as cdk from "aws-cdk-lib"; | ||
import { TestAppStack } from "../lib/test-app-stack"; | ||
import { GitHubStack } from "../lib/test-app-github-stack"; | ||
|
||
const owner = "eresearchqut"; | ||
const repo = "transcription"; | ||
|
||
const app = new cdk.App(); | ||
const githubActionsSynthesizer = new cdk.CliCredentialsStackSynthesizer({ | ||
fileAssetsBucketName: `${"${AWS::AccountId}"}-${owner}-${repo}-asset-bucket` | ||
}); | ||
|
||
new TestAppStack(app, "TestAppStack", { | ||
synthesizer: process.env.GITHUB_ACTIONS ? githubActionsSynthesizer : undefined | ||
}); | ||
new GitHubStack(app, "GitHubStack", { owner, repo }); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,60 @@ | ||
{ | ||
"app": "npx ts-node --prefer-ts-exts bin/test-app.ts", | ||
"watch": { | ||
"include": [ | ||
"**" | ||
], | ||
"exclude": [ | ||
"README.md", | ||
"cdk*.json", | ||
"**/*.d.ts", | ||
"**/*.js", | ||
"tsconfig.json", | ||
"package*.json", | ||
"yarn.lock", | ||
"node_modules", | ||
"test" | ||
] | ||
}, | ||
"context": { | ||
"@aws-cdk/aws-lambda:recognizeLayerVersion": true, | ||
"@aws-cdk/core:checkSecretUsage": true, | ||
"@aws-cdk/core:target-partitions": [ | ||
"aws", | ||
"aws-cn" | ||
], | ||
"@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver": true, | ||
"@aws-cdk/aws-ec2:uniqueImdsv2TemplateName": true, | ||
"@aws-cdk/aws-ecs:arnFormatIncludesClusterName": true, | ||
"@aws-cdk/aws-iam:minimizePolicies": true, | ||
"@aws-cdk/core:validateSnapshotRemovalPolicy": true, | ||
"@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName": true, | ||
"@aws-cdk/aws-s3:createDefaultLoggingPolicy": true, | ||
"@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption": true, | ||
"@aws-cdk/aws-apigateway:disableCloudWatchRole": true, | ||
"@aws-cdk/core:enablePartitionLiterals": true, | ||
"@aws-cdk/aws-events:eventsTargetQueueSameAccount": true, | ||
"@aws-cdk/aws-iam:standardizedServicePrincipals": true, | ||
"@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker": true, | ||
"@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName": true, | ||
"@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy": true, | ||
"@aws-cdk/aws-route53-patters:useCertificate": true, | ||
"@aws-cdk/customresources:installLatestAwsSdkDefault": false, | ||
"@aws-cdk/aws-rds:databaseProxyUniqueResourceName": true, | ||
"@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup": true, | ||
"@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId": true, | ||
"@aws-cdk/aws-ec2:launchTemplateDefaultUserData": true, | ||
"@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments": true, | ||
"@aws-cdk/aws-redshift:columnId": true, | ||
"@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2": true, | ||
"@aws-cdk/aws-ec2:restrictDefaultSecurityGroup": true, | ||
"@aws-cdk/aws-apigateway:requestValidatorUniqueId": true, | ||
"@aws-cdk/aws-kms:aliasNameRef": true, | ||
"@aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfig": true, | ||
"@aws-cdk/core:includePrefixInUniqueNameGeneration": true, | ||
"@aws-cdk/aws-efs:denyAnonymousAccess": true, | ||
"@aws-cdk/aws-opensearchservice:enableOpensearchMultiAzWithStandby": true, | ||
"@aws-cdk/aws-lambda-nodejs:useLatestRuntimeVersion": true, | ||
"@aws-cdk/aws-efs:mountTargetOrderInsensitiveLogicalId": true | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,8 @@ | ||
module.exports = { | ||
testEnvironment: 'node', | ||
roots: ['<rootDir>/test'], | ||
testMatch: ['**/*.test.ts'], | ||
transform: { | ||
'^.+\\.tsx?$': 'ts-jest' | ||
} | ||
}; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,59 @@ | ||
import * as cdk from "aws-cdk-lib"; | ||
import * as iam from "aws-cdk-lib/aws-iam"; | ||
import * as s3 from "aws-cdk-lib/aws-s3"; | ||
import { Construct } from "constructs"; | ||
|
||
|
||
export interface GitHubStackProps extends cdk.StackProps { | ||
readonly owner: string; | ||
readonly repo: string; | ||
readonly filters?: string[]; | ||
} | ||
|
||
export class GitHubStack extends cdk.Stack { | ||
constructor(scope: Construct, id: string, props: GitHubStackProps) { | ||
super(scope, id, props); | ||
const filters = props.filters ?? ["*"]; | ||
|
||
const provider = new iam.OpenIdConnectProvider(this, "oidc-provider-github", { | ||
url: `https://token.actions.githubusercontent.com`, | ||
clientIds: ["sts.amazonaws.com"] | ||
}); | ||
|
||
const principal = new iam.WebIdentityPrincipal(provider.openIdConnectProviderArn, { | ||
StringLike: { | ||
[`token.actions.githubusercontent.com:sub`]: filters.map(filter => `repo:${props.owner}/${props.repo}:${filter}`) | ||
} | ||
}); | ||
|
||
const assetBucket = new s3.Bucket(this, "asset-bucket", { | ||
bucketName: `${cdk.Aws.ACCOUNT_ID}-${props.owner}-${props.repo}-asset-bucket`, | ||
removalPolicy: cdk.RemovalPolicy.DESTROY | ||
}); | ||
|
||
const deployRole = new iam.Role(this, "deploy-role", { | ||
assumedBy: principal, | ||
description: "This role is used via GitHub Actions to deploy with AWS CDK on the target AWS account", | ||
// read account from STS | ||
inlinePolicies: { | ||
"read-account": new iam.PolicyDocument({ | ||
statements: [ | ||
new iam.PolicyStatement({ | ||
effect: iam.Effect.ALLOW, | ||
actions: ["sts:GetCallerIdentity"], | ||
resources: ["*"] | ||
})] | ||
}) | ||
}, | ||
maxSessionDuration: cdk.Duration.hours(1) | ||
}); | ||
|
||
assetBucket.grantReadWrite(deployRole); | ||
|
||
new cdk.CfnOutput(this, "deployRoleArn", { | ||
value: deployRole.roleArn, | ||
description: "The role used via GitHub Actions to deploy with AWS CDK on the target AWS account", | ||
exportName: "deployRoleArn" | ||
}); | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,21 @@ | ||
import * as cdk from "aws-cdk-lib"; | ||
import * as s3 from "aws-cdk-lib/aws-s3"; | ||
import * as ddb from "aws-cdk-lib/aws-dynamodb"; | ||
|
||
// import * as sqs from 'aws-cdk-lib/aws-sqs'; | ||
|
||
export class TestAppStack extends cdk.Stack { | ||
constructor(scope: cdk.App, id: string, props?: cdk.StackProps) { | ||
super(scope, id, props); | ||
|
||
new s3.Bucket(this, "MyFirstBucket", { | ||
versioned: true | ||
}); | ||
|
||
new ddb.Table(this, "MyFirstTable", { | ||
partitionKey: { name: "pk", type: ddb.AttributeType.STRING }, | ||
sortKey: { name: "sk", type: ddb.AttributeType.STRING }, | ||
billingMode: ddb.BillingMode.PAY_PER_REQUEST | ||
}); | ||
} | ||
} |
Oops, something went wrong.