-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
5fb3070
commit f287e20
Showing
16 changed files
with
4,669 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,34 @@ | ||
name: Deploy CDK Stack | ||
on: | ||
push: | ||
branches: | ||
- cdk | ||
jobs: | ||
deploy: | ||
runs-on: ubuntu-latest | ||
permissions: | ||
actions: write | ||
contents: read | ||
id-token: write | ||
steps: | ||
- uses: actions/checkout@v4 | ||
- name: Setup Node.js | ||
uses: actions/setup-node@v3 | ||
with: | ||
node-version: '18' | ||
cache: 'npm' | ||
cache-dependency-path: test-app | ||
- name: Install CDK | ||
run: npm install -g aws-cdk | ||
- name: Install dependencies | ||
working-directory: test-app | ||
run: npm install | ||
- uses: aws-actions/configure-aws-credentials@v4 | ||
with: | ||
aws-region: ap-southeast-2 | ||
role-to-assume: arn:aws:iam::854640616043:role/GitHubStack-deployroleC69923DD-OA180AXTYB0M | ||
role-duration-seconds: 900 | ||
output-credentials: true | ||
- name: Deploy CDK Stack | ||
working-directory: test-app | ||
run: cdk deploy -r arn:aws:iam::854640616043:role/GitHubStack-cfninvokeroleB16FCF7B-1MHMO65V0XL4N TestAppStack |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,8 @@ | ||
*.js | ||
!jest.config.js | ||
*.d.ts | ||
node_modules | ||
|
||
# CDK asset staging directory | ||
.cdk.staging | ||
cdk.out |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
*.ts | ||
!*.d.ts | ||
|
||
# CDK asset staging directory | ||
.cdk.staging | ||
cdk.out |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,14 @@ | ||
# Welcome to your CDK TypeScript project | ||
|
||
This is a blank project for CDK development with TypeScript. | ||
|
||
The `cdk.json` file tells the CDK Toolkit how to execute your app. | ||
|
||
## Useful commands | ||
|
||
* `npm run build` compile typescript to js | ||
* `npm run watch` watch for changes and compile | ||
* `npm run test` perform the jest unit tests | ||
* `cdk deploy` deploy this stack to your default AWS account/region | ||
* `cdk diff` compare deployed stack with current state | ||
* `cdk synth` emits the synthesized CloudFormation template |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,26 @@ | ||
#!/usr/bin/env node | ||
import "source-map-support/register"; | ||
import * as cdk from "aws-cdk-lib"; | ||
import { TestAppStack } from "../lib/test-app-stack"; | ||
import { GitHubStack } from "../lib/test-app-github-stack"; | ||
|
||
const app = new cdk.App(); | ||
new TestAppStack(app, "TestAppStack", { | ||
/* If you don't specify 'env', this stack will be environment-agnostic. | ||
* Account/Region-dependent features and context lookups will not work, | ||
* but a single synthesized template can be deployed anywhere. */ | ||
|
||
/* Uncomment the next line to specialize this stack for the AWS Account | ||
* and Region that are implied by the current CLI configuration. */ | ||
// env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: process.env.CDK_DEFAULT_REGION }, | ||
|
||
/* Uncomment the next line if you know exactly what Account and Region you | ||
* want to deploy the stack to. */ | ||
// env: { account: '123456789012', region: 'us-east-1' }, | ||
|
||
/* For more information, see https://docs.aws.amazon.com/cdk/latest/guide/environments.html */ | ||
}); | ||
new GitHubStack(app, "GitHubStack", { | ||
owner: "eresearchqut", | ||
repo: "transcription" | ||
}); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,60 @@ | ||
{ | ||
"app": "npx ts-node --prefer-ts-exts bin/test-app.ts", | ||
"watch": { | ||
"include": [ | ||
"**" | ||
], | ||
"exclude": [ | ||
"README.md", | ||
"cdk*.json", | ||
"**/*.d.ts", | ||
"**/*.js", | ||
"tsconfig.json", | ||
"package*.json", | ||
"yarn.lock", | ||
"node_modules", | ||
"test" | ||
] | ||
}, | ||
"context": { | ||
"@aws-cdk/aws-lambda:recognizeLayerVersion": true, | ||
"@aws-cdk/core:checkSecretUsage": true, | ||
"@aws-cdk/core:target-partitions": [ | ||
"aws", | ||
"aws-cn" | ||
], | ||
"@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver": true, | ||
"@aws-cdk/aws-ec2:uniqueImdsv2TemplateName": true, | ||
"@aws-cdk/aws-ecs:arnFormatIncludesClusterName": true, | ||
"@aws-cdk/aws-iam:minimizePolicies": true, | ||
"@aws-cdk/core:validateSnapshotRemovalPolicy": true, | ||
"@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName": true, | ||
"@aws-cdk/aws-s3:createDefaultLoggingPolicy": true, | ||
"@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption": true, | ||
"@aws-cdk/aws-apigateway:disableCloudWatchRole": true, | ||
"@aws-cdk/core:enablePartitionLiterals": true, | ||
"@aws-cdk/aws-events:eventsTargetQueueSameAccount": true, | ||
"@aws-cdk/aws-iam:standardizedServicePrincipals": true, | ||
"@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker": true, | ||
"@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName": true, | ||
"@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy": true, | ||
"@aws-cdk/aws-route53-patters:useCertificate": true, | ||
"@aws-cdk/customresources:installLatestAwsSdkDefault": false, | ||
"@aws-cdk/aws-rds:databaseProxyUniqueResourceName": true, | ||
"@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup": true, | ||
"@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId": true, | ||
"@aws-cdk/aws-ec2:launchTemplateDefaultUserData": true, | ||
"@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments": true, | ||
"@aws-cdk/aws-redshift:columnId": true, | ||
"@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2": true, | ||
"@aws-cdk/aws-ec2:restrictDefaultSecurityGroup": true, | ||
"@aws-cdk/aws-apigateway:requestValidatorUniqueId": true, | ||
"@aws-cdk/aws-kms:aliasNameRef": true, | ||
"@aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfig": true, | ||
"@aws-cdk/core:includePrefixInUniqueNameGeneration": true, | ||
"@aws-cdk/aws-efs:denyAnonymousAccess": true, | ||
"@aws-cdk/aws-opensearchservice:enableOpensearchMultiAzWithStandby": true, | ||
"@aws-cdk/aws-lambda-nodejs:useLatestRuntimeVersion": true, | ||
"@aws-cdk/aws-efs:mountTargetOrderInsensitiveLogicalId": true | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,8 @@ | ||
module.exports = { | ||
testEnvironment: 'node', | ||
roots: ['<rootDir>/test'], | ||
testMatch: ['**/*.test.ts'], | ||
transform: { | ||
'^.+\\.tsx?$': 'ts-jest' | ||
} | ||
}; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,94 @@ | ||
import * as cdk from "aws-cdk-lib"; | ||
import * as iam from "aws-cdk-lib/aws-iam"; | ||
import { Construct } from "constructs"; | ||
|
||
|
||
export interface GitHubStackProps extends cdk.StackProps { | ||
readonly owner: string; | ||
readonly repo: string; | ||
readonly filters?: string[]; | ||
} | ||
|
||
export class GitHubStack extends cdk.Stack { | ||
constructor(scope: Construct, id: string, props: GitHubStackProps) { | ||
super(scope, id, props); | ||
const filters = props.filters ?? ["*"]; | ||
|
||
const provider = new iam.OpenIdConnectProvider(this, "oidc-provider-github", { | ||
url: `https://token.actions.githubusercontent.com`, | ||
clientIds: ["sts.amazonaws.com"] | ||
}); | ||
|
||
const principal = new iam.WebIdentityPrincipal(provider.openIdConnectProviderArn, { | ||
StringLike: { | ||
[`token.actions.githubusercontent.com:sub`]: filters.map(filter => `repo:${props.owner}/${props.repo}:${filter}`) | ||
} | ||
}); | ||
|
||
const oidcPolicyStatement = new iam.PolicyStatement({ | ||
effect: iam.Effect.ALLOW, | ||
actions: ["sts:AssumeRole"], | ||
resources: ["*"], | ||
conditions: { | ||
"ForAnyValue:StringEquals": { | ||
"iam:ResourceTag/aws-cdk:bootstrap-role": [ | ||
"deploy", | ||
"lookup", | ||
"file-publishing", | ||
"image-publishing" | ||
] | ||
} | ||
} | ||
}); | ||
|
||
const ecrPolicyStatement = new iam.PolicyStatement({ | ||
effect: iam.Effect.ALLOW, | ||
actions: ["ecr:GetAuthorizationToken"], | ||
resources: ["*"] | ||
}); | ||
|
||
const passRolePolicyStatement = new iam.PolicyStatement({ | ||
effect: iam.Effect.ALLOW, | ||
actions: ["iam:PassRole"], | ||
// resources: [deployRole.roleArn] | ||
resources: ["*"] | ||
}); | ||
|
||
const deployRole = new iam.Role(this, "deploy-role", { | ||
assumedBy: principal, | ||
inlinePolicies: { | ||
"GitHubActions": new iam.PolicyDocument({ | ||
statements: [oidcPolicyStatement, ecrPolicyStatement, passRolePolicyStatement] | ||
}) | ||
}, | ||
description: "This role is used via GitHub Actions to deploy with AWS CDK on the target AWS account", | ||
maxSessionDuration: cdk.Duration.hours(1) | ||
}); | ||
|
||
|
||
const invokeRole = new iam.Role(this, "cfn-invoke-role", { | ||
assumedBy: principal, | ||
managedPolicies: [ | ||
iam.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess") | ||
], | ||
inlinePolicies: { | ||
"GitHubActions": new iam.PolicyDocument({ | ||
statements: [oidcPolicyStatement, passRolePolicyStatement] | ||
}) | ||
}, | ||
maxSessionDuration: cdk.Duration.hours(1) | ||
}); | ||
|
||
new cdk.CfnOutput(this, "deployRoleArn", { | ||
value: deployRole.roleArn, | ||
description: "The role used via GitHub Actions to deploy with AWS CDK on the target AWS account", | ||
exportName: "deployRoleArn" | ||
}); | ||
|
||
new cdk.CfnOutput(this, "invokeRoleArn", { | ||
value: invokeRole.roleArn, | ||
description: "The role used by CDK to to deploy the cloudformation stack", | ||
exportName: "invokeRoleArn" | ||
}); | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,21 @@ | ||
import * as cdk from "aws-cdk-lib"; | ||
import * as s3 from "aws-cdk-lib/aws-s3"; | ||
import * as ddb from "aws-cdk-lib/aws-dynamodb"; | ||
|
||
// import * as sqs from 'aws-cdk-lib/aws-sqs'; | ||
|
||
export class TestAppStack extends cdk.Stack { | ||
constructor(scope: cdk.App, id: string, props?: cdk.StackProps) { | ||
super(scope, id, props); | ||
|
||
new s3.Bucket(this, "MyFirstBucket", { | ||
versioned: true | ||
}); | ||
|
||
new ddb.Table(this, "MyFirstTable", { | ||
partitionKey: { name: "pk", type: ddb.AttributeType.STRING }, | ||
sortKey: { name: "sk", type: ddb.AttributeType.STRING }, | ||
billingMode: ddb.BillingMode.PAY_PER_REQUEST | ||
}); | ||
} | ||
} |
Oops, something went wrong.