construct).terminationProtection = true;
16 | }
17 | }
18 | }
19 |
20 | export function applyTerminationProtectionOnStacks(constructs: IConstruct[]) {
21 | constructs.forEach((construct) => {
22 | Aspects.of(construct).add(new EnableTerminationProtectionOnStacks());
23 | })
24 | }
25 |
--------------------------------------------------------------------------------
/lib/cloudfront_cdn.ts:
--------------------------------------------------------------------------------
1 | import * as s3 from 'aws-cdk-lib/aws-s3';
2 | import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
3 | import * as cloudfront_origins from 'aws-cdk-lib/aws-cloudfront-origins';
4 | import * as iam from 'aws-cdk-lib/aws-iam';
5 | import { Construct } from 'constructs';
6 | import { CfnOutput, Stack } from 'aws-cdk-lib';
7 |
8 | interface CloudfrontCdnProps {
9 | bucket: s3.Bucket;
10 | }
11 |
12 | export class CloudfrontCdn extends Construct {
13 | public readonly urlOutput: CfnOutput;
14 | constructor(parent: Stack, id: string, props: CloudfrontCdnProps) {
15 | super(parent, id);
16 |
17 | const cloudfrontOAI = new cloudfront.OriginAccessIdentity(this, 'cloudfront-OAI', {
18 | comment: 'OAI for artifact bucket cloudfront'
19 | });
20 |
21 | props.bucket.addToResourcePolicy(
22 | new iam.PolicyStatement({
23 | actions: ['s3:GetObject'],
24 | resources: [props.bucket.arnForObjects('*')],
25 | principals: [new iam.CanonicalUserPrincipal(cloudfrontOAI.cloudFrontOriginAccessIdentityS3CanonicalUserId)]
26 | })
27 | );
28 | new CfnOutput(this, 'S3 bucket', { value: props.bucket.bucketName });
29 |
30 | const distribution = new cloudfront.Distribution(this, 'ArtifactBucketDistribution', {
31 | defaultBehavior: {
32 | origin: new cloudfront_origins.S3Origin(props.bucket, {
33 | originAccessIdentity: cloudfrontOAI
34 | }),
35 | viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
36 | allowedMethods: cloudfront.AllowedMethods.ALLOW_GET_HEAD
37 | }
38 | });
39 | new CfnOutput(this, 'Distribution Id', {
40 | value: distribution.distributionId
41 | });
42 | this.urlOutput = new CfnOutput(this, 'Distribution Domain', {
43 | value: distribution.domainName
44 | });
45 | }
46 | }
47 |
--------------------------------------------------------------------------------
/lib/codebuild-stack.ts:
--------------------------------------------------------------------------------
1 | import * as cdk from 'aws-cdk-lib';
2 | import * as codebuild from 'aws-cdk-lib/aws-codebuild';
3 | import * as ec2 from 'aws-cdk-lib/aws-ec2';
4 | import * as iam from 'aws-cdk-lib/aws-iam';
5 | import { Key } from 'aws-cdk-lib/aws-kms';
6 | import { Construct } from 'constructs';
7 | import {
8 | BuildImageOS,
9 | GITHUB_ALLOWLISTED_ACCOUNT_IDS,
10 | LinuxAMIBuildImage,
11 | MacAMIBuildImage,
12 | toStackName,
13 | WindowsAMIBuildImage
14 | } from './utils';
15 |
16 | const webhookFiltersArr: codebuild.FilterGroup[] = [];
17 |
18 | for (const userId of GITHUB_ALLOWLISTED_ACCOUNT_IDS) {
19 | console.log('creating filter group for userid: ', userId);
20 | webhookFiltersArr.push(
21 | codebuild.FilterGroup.inEventOf(codebuild.EventAction.WORKFLOW_JOB_QUEUED).andActorAccountIs(userId)
22 | );
23 | }
24 |
25 | const githHubSource = codebuild.Source.gitHub({
26 | owner: 'runfinch',
27 | repo: 'finch',
28 | webhook: true,
29 | webhookFilters: webhookFiltersArr,
30 | fetchSubmodules: true,
31 | cloneDepth: 0,
32 | });
33 |
34 | interface ImageFilterProps {
35 | 'virtualization-type': string[];
36 | 'root-device-type': string[];
37 | 'owner-alias': string[];
38 | }
39 |
40 | /**
41 | * Default properties for CodeBuildStack configuration.
42 | * Contains static readonly properties that define default values for image filters,
43 | * fleet configuration, and project environment settings.
44 | */
45 | class CodeBuildStackDefaultProps {
46 | static readonly imageFilterProps: ImageFilterProps = {
47 | 'virtualization-type': ['hvm'],
48 | 'root-device-type': ['ebs'],
49 | 'owner-alias': ['amazon']
50 | };
51 | static readonly fleetProps = {
52 | computeType: codebuild.FleetComputeType.MEDIUM,
53 | baseCapacity: 1
54 | };
55 | static readonly projectEnvironmentProps = {
56 | computeType: codebuild.ComputeType.MEDIUM
57 | };
58 | static readonly terminationProtection: boolean = true;
59 | }
60 |
61 | class CodeBuildStackProps {
62 | env: cdk.Environment | undefined;
63 | projectName: string;
64 | region: string;
65 | arch: string;
66 | operatingSystem: string;
67 | amiSearchString: string;
68 | environmentType: codebuild.EnvironmentType;
69 | buildImageOS: BuildImageOS;
70 | imageFilterProps?: ImageFilterProps;
71 | fleetProps?: {
72 | computeType: codebuild.FleetComputeType;
73 | baseCapacity: number;
74 | };
75 | projectEnvironmentProps?: {
76 | computeType: codebuild.ComputeType;
77 | };
78 | }
79 |
80 | export class CodeBuildStack extends cdk.Stack {
81 | constructor(scope: Construct, id: string, props: CodeBuildStackProps) {
82 | super(scope, id, {
83 | ...props,
84 | terminationProtection: CodeBuildStackDefaultProps.terminationProtection,
85 | });
86 | this.createBuildProject(props, id);
87 | }
88 |
89 | private createBuildProject(props: CodeBuildStackProps, id: string): codebuild.Project {
90 | const platformId: string = `${props.operatingSystem}-${toStackName(props.arch)}`;
91 |
92 | const secretArn = this.formatArn({
93 | service: 'secretsmanager',
94 | resource: 'secret',
95 | resourceName: `codebuild-github-access-token-??????`,
96 | arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME
97 | });
98 |
99 | const machineImageProps = {
100 | name: props.amiSearchString,
101 | filters: {
102 | ...(props.imageFilterProps || CodeBuildStackDefaultProps.imageFilterProps),
103 | architecture: [props.arch]
104 | }
105 | };
106 | const machineImage = new ec2.LookupMachineImage(machineImageProps);
107 |
108 | const fleetServiceRole = new iam.Role(this, `FleetServiceRole-${platformId}`, {
109 | assumedBy: new iam.ServicePrincipal('codebuild.amazonaws.com'),
110 | managedPolicies: [
111 | iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonEC2FullAccess'),
112 | iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore')
113 | ]
114 | });
115 |
116 | const fleet = new codebuild.Fleet(this, `Fleet-${toStackName(props.arch)}`, {
117 | ...(props.fleetProps || CodeBuildStackDefaultProps.fleetProps),
118 | environmentType: props.environmentType
119 | });
120 |
121 | const imageId: string = machineImage.getImage(this).imageId;
122 |
123 | const cfnFleet = fleet.node.defaultChild as cdk.CfnResource;
124 | cfnFleet.addPropertyOverride('ImageId', imageId);
125 | cfnFleet.addPropertyOverride('FleetServiceRole', fleetServiceRole.roleArn);
126 |
127 | const codebuildProject = new codebuild.Project(this, id, {
128 | projectName: props.projectName,
129 | source: githHubSource,
130 | environment: {
131 | ...(props.projectEnvironmentProps || CodeBuildStackDefaultProps.projectEnvironmentProps),
132 | fleet: fleet,
133 | buildImage: this.getBuildImageByOS(props.buildImageOS, props.environmentType, imageId)
134 | },
135 | encryptionKey: new Key(this, `codebuild-${platformId}-key-${props.region}`, {
136 | description: 'Kms Key to encrypt data-at-rest',
137 | alias: `finch-${platformId}-kms-${props.region}`,
138 | enabled: true
139 | })
140 | });
141 |
142 | codebuildProject.addToRolePolicy(
143 | new iam.PolicyStatement({
144 | actions: ['secretsmanager:GetSecretValue'],
145 | resources: [secretArn]
146 | })
147 | );
148 |
149 | return codebuildProject;
150 | }
151 |
152 | private getBuildImageByOS(
153 | os: BuildImageOS,
154 | environmentType: codebuild.EnvironmentType,
155 | imageId: string
156 | ): cdk.aws_codebuild.IBuildImage {
157 | switch (os) {
158 | case BuildImageOS.LINUX:
159 | return new LinuxAMIBuildImage(imageId, environmentType);
160 | case BuildImageOS.MAC:
161 | return new MacAMIBuildImage(imageId, environmentType);
162 | case BuildImageOS.WINDOWS:
163 | return new WindowsAMIBuildImage(imageId, environmentType);
164 | default:
165 | throw new Error(`Unsupported Build Image OS: ${os}`);
166 | }
167 | }
168 | }
169 |
--------------------------------------------------------------------------------
/lib/continuous-integration-stack.ts:
--------------------------------------------------------------------------------
1 | import * as cdk from 'aws-cdk-lib';
2 | import * as ecr from 'aws-cdk-lib/aws-ecr';
3 | import * as s3 from 'aws-cdk-lib/aws-s3';
4 | import * as iam from 'aws-cdk-lib/aws-iam';
5 | import { Construct } from 'constructs';
6 |
7 | import { CloudfrontCdn } from './cloudfront_cdn';
8 | import { applyTerminationProtectionOnStacks } from './aspects/stack-termination-protection';
9 |
10 | interface ContinuousIntegrationStackProps extends cdk.StackProps {
11 | rootfsEcrRepository: ecr.Repository;
12 | }
13 |
14 | // ContinuousIntegrationStack - AWS stack for supporting Finch's continuous integration process
15 | export class ContinuousIntegrationStack extends cdk.Stack {
16 | constructor(scope: Construct, id: string, stage: string, props: ContinuousIntegrationStackProps) {
17 | super(scope, id, props);
18 | applyTerminationProtectionOnStacks([this]);
19 |
20 | const githubDomain = 'token.actions.githubusercontent.com';
21 |
22 | const ghProvider = new iam.OpenIdConnectProvider(this, 'githubProvider', {
23 | url: `https://${githubDomain}`,
24 | clientIds: ['sts.amazonaws.com']
25 | });
26 |
27 | const githubActionsRole = new iam.Role(this, 'GithubActionsRole', {
28 | assumedBy: new iam.WebIdentityPrincipal(ghProvider.openIdConnectProviderArn),
29 | roleName: 'GithubActionsRole',
30 | description: 'This role is used by GitHub Actions',
31 | maxSessionDuration: cdk.Duration.hours(1)
32 | });
33 |
34 | // Override docs: https://docs.aws.amazon.com/cdk/v2/guide/cfn_layer.html#cfn_layer_raw
35 | // Condition from: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html#idp_oidc_Create_GitHub
36 | const cfnRole = githubActionsRole.node.defaultChild as iam.CfnRole;
37 | cfnRole.addOverride('Properties.AssumeRolePolicyDocument.Statement.0.Condition', {
38 | StringLike: {
39 | 'token.actions.githubusercontent.com:aud': 'sts.amazonaws.com',
40 | 'token.actions.githubusercontent.com:sub': 'repo:runfinch/*'
41 | }
42 | });
43 |
44 | const bucketName = `finch-dependencies-${stage.toLowerCase()}-${cdk.Stack.of(this)?.account}`;
45 |
46 | const bucket = new s3.Bucket(this, 'Dependencies', {
47 | bucketName,
48 | publicReadAccess: false,
49 | blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL
50 | });
51 | bucket.grantReadWrite(githubActionsRole);
52 |
53 | const repo = props.rootfsEcrRepository;
54 | repo.grantPullPush(githubActionsRole);
55 | ecr.AuthorizationToken.grantRead(githubActionsRole)
56 |
57 | new CloudfrontCdn(this, 'DependenciesCloudfrontCdn', {
58 | bucket
59 | });
60 | }
61 | }
62 |
--------------------------------------------------------------------------------
/lib/ecr-repo-stack.ts:
--------------------------------------------------------------------------------
1 | import * as cdk from 'aws-cdk-lib';
2 | import { CfnOutput } from 'aws-cdk-lib';
3 | import * as ecr from 'aws-cdk-lib/aws-ecr';
4 | import { Construct } from 'constructs';
5 | import { applyTerminationProtectionOnStacks } from './aspects/stack-termination-protection';
6 |
7 | export class ECRRepositoryStack extends cdk.Stack {
8 | public readonly repositoryOutput: CfnOutput;
9 | public readonly repository: ecr.Repository;
10 | constructor(scope: Construct, id: string, stage: string, props?: cdk.StackProps) {
11 | super(scope, id, props);
12 | applyTerminationProtectionOnStacks([this]);
13 |
14 | const repoName = `finch-rootfs-image-${stage.toLowerCase()}`;
15 | const ecrRepository = new ecr.Repository(this, 'finch-rootfs', {
16 | repositoryName:repoName,
17 | imageTagMutability: ecr.TagMutability.IMMUTABLE,
18 | // TODO: CFN does not provide APIs for enhanced image scanning.
19 | // To address, create a custom stack that uses the AWS sdk to change the account ECR
20 | // scanning settings to enhanced.
21 |
22 | // For now, scan on image push is set to true. This means that the image will be scanned
23 | // for vulnerabilites every time it is pushed up to the ECR repo. With enhanced scanning,
24 | // the image would be continously scanned for vulnerabilities.
25 | // See https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-enhanced.html
26 | imageScanOnPush: true,
27 | });
28 |
29 | this.repository = ecrRepository
30 | this.repositoryOutput = new CfnOutput(this, 'ECR repository', { value: ecrRepository.repositoryName });
31 | }
32 | }
33 |
--------------------------------------------------------------------------------
/lib/event-bridge-scan-notifs-stack.ts:
--------------------------------------------------------------------------------
1 | import * as cdk from 'aws-cdk-lib';
2 | import * as events from 'aws-cdk-lib/aws-events';
3 | import * as iam from 'aws-cdk-lib/aws-iam';
4 | import * as lambda from 'aws-cdk-lib/aws-lambda';
5 | import * as sns from 'aws-cdk-lib/aws-sns';
6 | import * as subscriptions from 'aws-cdk-lib/aws-sns-subscriptions';
7 | import * as targets from 'aws-cdk-lib/aws-events-targets';
8 | import { Construct } from 'constructs';
9 | import path from 'path';
10 | import { applyTerminationProtectionOnStacks } from './aspects/stack-termination-protection';
11 |
12 | export class EventBridgeScanNotifsStack extends cdk.Stack {
13 | constructor(scope: Construct, id: string, stage: string, props?: cdk.StackProps) {
14 | super(scope, id, props);
15 | applyTerminationProtectionOnStacks([this]);
16 |
17 | const topic = new sns.Topic(this, 'ECR Image Inspector Findings');
18 |
19 | // Let's not expose this on GitHub, will only be visible in AWS logs Finch team owns, which is low risk.
20 | // Secret has to be created only in Prod account.
21 | // unsafeUnwrap is used because SNS does not have any construct that accepts a SecretValue property.
22 | const securityEmail = cdk.SecretValue.secretsManager('security-notifications-email').unsafeUnwrap()
23 | topic.addSubscription(new subscriptions.EmailSubscription(securityEmail.toString()));
24 |
25 | const notificationFn = new lambda.Function(this, 'SendECRImageInspectorFindings', {
26 | runtime: lambda.Runtime.PYTHON_3_11,
27 | handler: 'main.lambda_handler',
28 | code: lambda.Code.fromAsset(path.join(__dirname, 'image-scanning-notifications-lambda-handler')),
29 | environment: {'SNS_ARN': topic.topicArn,},
30 | });
31 |
32 | const snsTopicPolicy = new iam.PolicyStatement({
33 | actions: ['sns:publish'],
34 | resources: ['*'],
35 | });
36 |
37 | notificationFn.addToRolePolicy(snsTopicPolicy);
38 |
39 | // Only publish CRITICAL and HIGH findings (more than 7.0 CVE score) that are ACTIVE
40 | // https://docs.aws.amazon.com/inspector/latest/user/findings-understanding-severity.html
41 | const rule = new events.Rule(this, 'rule', {
42 | eventPattern: {
43 | source: ['aws.inspector2'],
44 | detail: {
45 | severity: ['HIGH', 'CRITICAL'],
46 | status: events.Match.exactString('ACTIVE')
47 | },
48 | detailType: events.Match.exactString('Inspector2 Finding'),
49 | },
50 | });
51 |
52 | rule.addTarget(new targets.LambdaFunction(notificationFn))
53 | }
54 | }
--------------------------------------------------------------------------------
/lib/finch-pipeline-app-stage.ts:
--------------------------------------------------------------------------------
1 | import * as cdk from 'aws-cdk-lib';
2 | import { CfnOutput } from 'aws-cdk-lib';
3 | import * as codebuild from 'aws-cdk-lib/aws-codebuild';
4 | import * as ecr from 'aws-cdk-lib/aws-ecr';
5 | import * as s3 from 'aws-cdk-lib/aws-s3';
6 | import { Construct } from 'constructs';
7 | import { PlatformType, RunnerProps } from '../config/runner-config';
8 | import { ArtifactBucketCloudfrontStack } from './artifact-bucket-cloudfront';
9 | import { ASGRunnerStack } from './asg-runner-stack';
10 | import { applyTerminationProtectionOnStacks } from './aspects/stack-termination-protection';
11 | import { CodeBuildStack } from './codebuild-stack';
12 | import { ContinuousIntegrationStack } from './continuous-integration-stack';
13 | import { ECRRepositoryStack } from './ecr-repo-stack';
14 | import { EventBridgeScanNotifsStack } from './event-bridge-scan-notifs-stack';
15 | import { PVREReportingStack } from './pvre-reporting-stack';
16 | import { SSMPatchingStack } from './ssm-patching-stack';
17 | import { CODEBUILD_STACKS, toStackName } from './utils';
18 |
19 | export enum ENVIRONMENT_STAGE {
20 | Beta,
21 | Prod,
22 | Release
23 | }
24 |
25 | interface FinchPipelineAppStageProps extends cdk.StageProps {
26 | environmentStage: ENVIRONMENT_STAGE;
27 | runnerConfig: RunnerProps;
28 | }
29 |
30 | export class FinchPipelineAppStage extends cdk.Stage {
31 | artifactBucketCloudfrontUrlOutput: CfnOutput;
32 | ecrRepositoryOutput: CfnOutput;
33 | public readonly cloudfrontBucket: s3.Bucket;
34 | public readonly ecrRepository: ecr.Repository;
35 |
36 | constructor(scope: Construct, id: string, props: FinchPipelineAppStageProps) {
37 | super(scope, id, props);
38 | applyTerminationProtectionOnStacks([this]);
39 | props.runnerConfig.runnerTypes.forEach((runnerType) => {
40 | const ASGStackName = `ASG-${runnerType.platform}-${runnerType.repo}-${runnerType.version.split('.')[0]}-${runnerType.arch}Stack`;
41 | let licenseArn: string | undefined;
42 | switch (runnerType.platform) {
43 | case PlatformType.MAC: {
44 | licenseArn = props.runnerConfig.macLicenseArn;
45 | break;
46 | }
47 | case PlatformType.WINDOWS: {
48 | licenseArn = props.runnerConfig.windowsLicenseArn;
49 | break;
50 | }
51 | }
52 | new ASGRunnerStack(this, ASGStackName, {
53 | env: props.env,
54 | stage: props.environmentStage,
55 | type: runnerType,
56 | licenseArn
57 | });
58 | });
59 |
60 | if (props.environmentStage !== ENVIRONMENT_STAGE.Release) {
61 | const artifactBucketCloudfrontStack = new ArtifactBucketCloudfrontStack(
62 | this,
63 | 'ArtifactCloudfront',
64 | this.stageName
65 | );
66 | this.artifactBucketCloudfrontUrlOutput = artifactBucketCloudfrontStack.urlOutput;
67 | this.cloudfrontBucket = artifactBucketCloudfrontStack.bucket;
68 |
69 | const ecrRepositoryStack = new ECRRepositoryStack(this, 'ECRRepositoryStack', this.stageName);
70 |
71 | this.ecrRepositoryOutput = ecrRepositoryStack.repositoryOutput;
72 | this.ecrRepository = ecrRepositoryStack.repository;
73 |
74 | // Only report rootfs image scans in prod to avoid duplicate notifications.
75 | if (props.environmentStage == ENVIRONMENT_STAGE.Prod) {
76 | new EventBridgeScanNotifsStack(this, 'EventBridgeScanNotifsStack', this.stageName);
77 | }
78 |
79 | new ContinuousIntegrationStack(this, 'FinchContinuousIntegrationStack', this.stageName, {
80 | rootfsEcrRepository: this.ecrRepository
81 | });
82 | }
83 |
84 | new PVREReportingStack(this, 'PVREReportingStack', { terminationProtection: true });
85 |
86 | new SSMPatchingStack(this, 'SSMPatchingStack', { terminationProtection: true });
87 |
88 | // Create Ubuntu Codebuild projects for each arch
89 | // CodeBuild credentials are account-wide, so creating them multiple times within the for
90 | // loop causes an error.
91 | // TODO: refactor CodeBuildStack into CodeBuildProjects and loop inside of the constructor.
92 | const codebuildCredsStack = new (class CodeBuildCredentialsStack extends cdk.Stack {
93 | constructor(scope: Construct, id: string) {
94 | super(scope, id, {
95 | ...props,
96 | terminationProtection: true,
97 | });
98 | new codebuild.GitHubSourceCredentials(this, `code-build-credentials`, {
99 | accessToken: cdk.SecretValue.secretsManager('codebuild-github-access-token')
100 | });
101 | }
102 | })(this, 'CodeBuildStack-credentials');
103 |
104 | for (const { arch, operatingSystem, amiSearchString, environmentType, buildImageOS } of CODEBUILD_STACKS) {
105 | const codeBuildStack = new CodeBuildStack(this, `CodeBuildStack-${operatingSystem}-${toStackName(arch)}`, {
106 | env: props.env,
107 | projectName: `finch-${arch}-${props.environmentStage}-instance`,
108 | region: 'us-west-2',
109 | arch,
110 | amiSearchString,
111 | operatingSystem,
112 | buildImageOS: buildImageOS,
113 | environmentType: environmentType
114 | });
115 |
116 | codeBuildStack.addDependency(codebuildCredsStack);
117 | }
118 | }
119 | }
120 |
--------------------------------------------------------------------------------
/lib/finch-pipeline-stack.ts:
--------------------------------------------------------------------------------
1 | import * as cdk from 'aws-cdk-lib';
2 | import { BuildSpec } from 'aws-cdk-lib/aws-codebuild';
3 | import { CodePipeline, CodePipelineSource, ShellStep } from 'aws-cdk-lib/pipelines';
4 | import { Construct } from 'constructs';
5 | import { EnvConfig } from '../config/env-config';
6 | import { RunnerConfig } from '../config/runner-config';
7 | import { applyTerminationProtectionOnStacks } from './aspects/stack-termination-protection';
8 | import { ENVIRONMENT_STAGE, FinchPipelineAppStage } from './finch-pipeline-app-stage';
9 |
10 | export class FinchPipelineStack extends cdk.Stack {
11 | constructor(scope: Construct, id: string, props?: cdk.StackProps) {
12 | super(scope, id, props);
13 | applyTerminationProtectionOnStacks([this]);
14 |
15 | const source = CodePipelineSource.gitHub('runfinch/infrastructure', 'main', {
16 | authentication: cdk.SecretValue.secretsManager('pipeline-github-access-token')
17 | });
18 |
19 | const pipeline = new CodePipeline(this, 'FinchPipeline', {
20 | pipelineName: 'FinchPipeline',
21 | crossAccountKeys: true,
22 | synth: new ShellStep('Synth', {
23 | input: source,
24 | commands: ['npm ci', 'npm run build', 'npx cdk synth']
25 | }),
26 | synthCodeBuildDefaults: {
27 | partialBuildSpec: BuildSpec.fromObject({
28 | phases: {
29 | install: {
30 | 'runtime-versions': {
31 | nodejs: '20'
32 | }
33 | }
34 | }
35 | })
36 | }
37 | });
38 |
39 | const betaApp = new FinchPipelineAppStage(this, 'Beta', {
40 | environmentStage: ENVIRONMENT_STAGE.Beta,
41 | env: {
42 | account: EnvConfig.envBeta.account,
43 | region: EnvConfig.envBeta.region
44 | },
45 | runnerConfig: RunnerConfig.runnerBeta
46 | });
47 | const betaStage = pipeline.addStage(betaApp);
48 | // add a post step for unit and integration tests
49 | betaStage.addPost(
50 | new ShellStep('Unit and Integration Test', {
51 | input: source,
52 | commands: ['npm install', 'npm run build', 'npm run test', 'npm run integration'],
53 | envFromCfnOutputs: {
54 | CLOUDFRONT_URL: betaApp.artifactBucketCloudfrontUrlOutput
55 | }
56 | })
57 | );
58 | // Add stages to a wave to deploy them in parallel.
59 | const wave = pipeline.addWave('wave');
60 |
61 | const prodApp = new FinchPipelineAppStage(this, 'Production', {
62 | environmentStage: ENVIRONMENT_STAGE.Prod,
63 | env: {
64 | account: EnvConfig.envProd.account,
65 | region: EnvConfig.envProd.region
66 | },
67 | runnerConfig: RunnerConfig.runnerProd
68 | });
69 | wave.addStage(prodApp);
70 |
71 | const releaseApp = new FinchPipelineAppStage(this, 'Release', {
72 | environmentStage: ENVIRONMENT_STAGE.Release,
73 | env: {
74 | account: EnvConfig.envRelease.account,
75 | region: EnvConfig.envRelease.region
76 | },
77 | runnerConfig: RunnerConfig.runnerRelease
78 | });
79 | wave.addStage(releaseApp);
80 | }
81 | }
82 |
--------------------------------------------------------------------------------
/lib/image-scanning-notifications-lambda-handler/main.py:
--------------------------------------------------------------------------------
1 | '''
2 | lambda function to read ECR Image Inpsection events from Amazon EventBridge
3 | and send notifications to Finch team regarding security notifications.
4 | '''
5 | import boto3
6 | import os
7 |
8 | def build_message(event):
9 | '''build_message reads an {event} from Inspector image scanning and builds
10 | the body of reporting email with vulnerability findings.
11 |
12 | :param EventBridgeEvent event: The EventBridgeEvent containing an Inspector scan finding.
13 |
14 | Schema: https://docs.aws.amazon.com/inspector/latest/user/eventbridge-integration.html#event-finding
15 | '''
16 | detail = event['detail']
17 | title = detail['title']
18 | description = detail['description']
19 | severity = detail['severity']
20 | source_url = detail['packageVulnerabilityDetails']['sourceUrl']
21 | status = detail['status']
22 | type = detail['type']
23 | finding_arn = detail['findingArn']
24 | first_observed_at = detail['firstObservedAt']
25 |
26 | message = f'''{title} - Severity {severity}
27 |
28 | Severity: {severity}
29 | Type: {type}
30 | Description: {description}
31 | Source URL: {source_url}
32 |
33 | Status: {status}
34 | Observed: {first_observed_at}
35 |
36 | For more info, view the finding via ARN in the AWS Console: {finding_arn}
37 | '''
38 |
39 | return message
40 |
41 | def send_sns(subject: str, message: str):
42 | '''send_sns sends an email with subject and body
43 |
44 | :param str subject: The subject of the email
45 | :param str message: The body of the email
46 | '''
47 | client = boto3.client("sns")
48 | topic_arn = os.environ["SNS_ARN"]
49 | client.publish(TopicArn=topic_arn, Message=message, Subject=subject)
50 |
51 | def lambda_handler(event, context) -> dict:
52 | '''lambda_handler handles EventBridge events, calling send_sns to send an email for security findings.
53 |
54 | :param EventBridgeEvent event: the EventBridge event
55 | :param LambdaContext context: the Lambda execution context
56 | '''
57 | detailType = event["detail-type"]
58 |
59 | if (detailType == "Inspector2 Finding"):
60 | subject = "Rootfs Image Security Finding"
61 | message = build_message(event)
62 | send_sns(subject, message)
63 | else:
64 | print("No findings found, skipping sending email")
65 |
66 | return {'statusCode': 200}
67 |
--------------------------------------------------------------------------------
/lib/pvre-reporting-stack.ts:
--------------------------------------------------------------------------------
1 | import * as cdk from 'aws-cdk-lib';
2 | import * as cfninc from 'aws-cdk-lib/cloudformation-include';
3 | import { Construct } from 'constructs';
4 | import { applyTerminationProtectionOnStacks } from './aspects/stack-termination-protection';
5 |
6 | export class PVREReportingStack extends cdk.Stack {
7 | constructor(scope: Construct, id: string, props?: cdk.StackProps) {
8 | super(scope, id, props);
9 | applyTerminationProtectionOnStacks([this]);
10 |
11 | new cfninc.CfnInclude(this, 'PVREReportingTemplate', {
12 | templateFile: 'lib/pvre-reporting-template.yml'
13 | });
14 | }
15 | }
16 |
--------------------------------------------------------------------------------
/lib/pvre-reporting-template.yml:
--------------------------------------------------------------------------------
1 | Resources:
2 | InventoryCollection:
3 | Type: "AWS::SSM::Association"
4 | Properties:
5 | Name: {Ref: PvreInventoryCollectionDocument}
6 | AssociationName:
7 | Fn::Sub: "${AWS::AccountId}-InventoryCollection"
8 | ScheduleExpression: "rate(12 hours)"
9 | Targets:
10 | - Key: "tag:PVRE-Reporting"
11 | Values:
12 | - "SSM"
13 | PvreReporting:
14 | Type: "AWS::SSM::ResourceDataSync"
15 | Properties:
16 | BucketName:
17 | Fn::Sub: "pvrev2-prod-${AWS::Region}-ssm-updates"
18 | BucketRegion:
19 | Ref: "AWS::Region"
20 | SyncFormat: "JsonSerDe"
21 | SyncName:
22 | Fn::Sub: "${AWS::AccountId}-PvreReporting"
23 | PvreInventoryCollectionDocument:
24 | Type: "AWS::SSM::Document"
25 | Properties:
26 | Name:
27 | Fn::Sub: "PVREInventoryCollectionDocument"
28 | DocumentType: "Command"
29 | Content:
30 | schemaVersion: "2.2"
31 | description: "Collect software inventory and kernel information"
32 | parameters:
33 | applications:
34 | type: "String"
35 | default: "Enabled"
36 | description: "(Optional) Collect data for installed applications."
37 | allowedValues:
38 | - "Enabled"
39 | - "Disabled"
40 | awsComponents:
41 | type: "String"
42 | default: "Enabled"
43 | description: "(Optional) Collect data for AWS Components like amazon-ssm-agent."
44 | allowedValues:
45 | - "Enabled"
46 | - "Disabled"
47 | files:
48 | type: "String"
49 | default: ""
50 | description: "(Optional, requires SSMAgent version 2.2.64.0 and above)
Linux example:
[{\"Path\":\"/usr/bin\", \"Pattern\":[\"aws*\", \"*ssm*\"],\"Recursive\":false},{\"Path\":\"/var/log\", \"Pattern\":[\"amazon*.*\"], \"Recursive\":true, \"DirScanLimit\":1000}]
Windows example:
[{\"Path\":\"%PROGRAMFILES%\", \"Pattern\":[\"*.exe\"],\"Recursive\":true}]
Learn More: http://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-inventory-about.html#sysman-inventory-file-and-registry
"
51 | displayType: "textarea"
52 | networkConfig:
53 | type: "String"
54 | default: "Enabled"
55 | description: "(Optional) Collect data for Network configurations."
56 | allowedValues:
57 | - "Enabled"
58 | - "Disabled"
59 | windowsUpdates:
60 | type: "String"
61 | default: "Enabled"
62 | description: "(Optional, Windows OS only) Collect data for all Windows Updates."
63 | allowedValues:
64 | - "Enabled"
65 | - "Disabled"
66 | instanceDetailedInformation:
67 | type: "String"
68 | default: "Enabled"
69 | description: "(Optional) Collect additional information about the instance, including the CPU model, speed, and the number of cores, to name a few."
70 | allowedValues:
71 | - "Enabled"
72 | - "Disabled"
73 | services:
74 | type: "String"
75 | default: "Enabled"
76 | description: "(Optional, Windows OS only, requires SSMAgent version 2.2.64.0 and above) Collect data for service configurations."
77 | allowedValues:
78 | - "Enabled"
79 | - "Disabled"
80 | windowsRegistry:
81 | type: "String"
82 | default: ""
83 | description: "(Optional, Windows OS only, requires SSMAgent version 2.2.64.0 and above)
Example:
[{\"Path\":\"HKEY_CURRENT_CONFIG\\System\",\"Recursive\":true},{\"Path\":\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Amazon\\MachineImage\", \"ValueNames\":[\"AMIName\"]}]
Learn More: http://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-inventory-about.html#sysman-inventory-file-and-registry
"
84 | displayType: "textarea"
85 | windowsRoles:
86 | type: "String"
87 | default: "Enabled"
88 | description: "(Optional, Windows OS only, requires SSMAgent version 2.2.64.0 and above) Collect data for Microsoft Windows role configurations."
89 | allowedValues:
90 | - "Enabled"
91 | - "Disabled"
92 | customInventory:
93 | type: "String"
94 | default: "Enabled"
95 | description: "(Optional) Collect data for custom inventory."
96 | allowedValues:
97 | - "Enabled"
98 | - "Disabled"
99 | billingInfo:
100 | type: "String"
101 | default: "Enabled"
102 | description: "(Optional) Collect billing info for license included applications."
103 | allowedValues:
104 | - "Enabled"
105 | - "Disabled"
106 | mainSteps:
107 | - action: "aws:runShellScript"
108 | name: "collectCustomInventoryItems"
109 | inputs:
110 | timeoutSeconds: 7200
111 | runCommand:
112 | - "#!/bin/bash"
113 | - "token=$(curl --silent --show-error --retry 3 -X PUT \"http://169.254.169.254/latest/api/token\" -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\")"
114 | - "instance_id=$(curl --silent --show-error --retry 3 -H \"X-aws-ec2-metadata-token: $token\" http://169.254.169.254/latest/meta-data/instance-id)"
115 | - "kernel_version=$(uname -r)"
116 | - "content=\"{\\\"SchemaVersion\\\": \\\"1.0\\\", \\\"TypeName\\\": \\\"Custom:SystemInfo\\\", \\\"Content\\\": {\\\"KernelVersion\\\": \\\"$kernel_version\\\"}}\""
117 | - "dir_path=\"/var/lib/amazon/ssm/$instance_id/inventory/custom\""
118 | - "mkdir -p $dir_path"
119 | - "echo $content > $dir_path/CustomSystemInfo.json"
120 | - action: "aws:softwareInventory"
121 | name: "collectSoftwareInventoryItems"
122 | inputs:
123 | applications: "{{ applications }}"
124 | awsComponents: "{{ awsComponents }}"
125 | networkConfig: "{{ networkConfig }}"
126 | files: "{{ files }}"
127 | services: "{{ services }}"
128 | windowsRoles: "{{ windowsRoles }}"
129 | windowsRegistry: "{{ windowsRegistry}}"
130 | windowsUpdates: "{{ windowsUpdates }}"
131 | instanceDetailedInformation: "{{ instanceDetailedInformation }}"
132 | billingInfo: "{{ billingInfo }}"
133 | customInventory: "{{ customInventory }}"
--------------------------------------------------------------------------------
/lib/ssm-patching-stack.ts:
--------------------------------------------------------------------------------
1 | import * as cdk from 'aws-cdk-lib';
2 | import { CfnMaintenanceWindow, CfnMaintenanceWindowTarget, CfnMaintenanceWindowTask } from 'aws-cdk-lib/aws-ssm';
3 | import { Construct } from 'constructs';
4 | import { applyTerminationProtectionOnStacks } from './aspects/stack-termination-protection';
5 |
6 | export class SSMPatchingStack extends cdk.Stack {
7 | constructor(scope: Construct, id: string, props?: cdk.StackProps) {
8 | super(scope, id, props);
9 | applyTerminationProtectionOnStacks([this]);
10 |
11 | const maintenanceWindow = new CfnMaintenanceWindow(this, 'MaintenanceWindow', {
12 | name: `Patching-Window`,
13 | allowUnassociatedTargets: false,
14 | cutoff: 0,
15 | duration: 2,
16 | // Every day at 8 AM UTC
17 | schedule: 'cron(0 8 ? * * *)'
18 | });
19 |
20 | const maintenanceTarget = new CfnMaintenanceWindowTarget(this, 'MaintenanceWindowTarget', {
21 | name: 'All-Instances-Patch-Target',
22 | windowId: maintenanceWindow.ref,
23 | resourceType: 'INSTANCE',
24 | targets: [
25 | {
26 | key: 'tag:PVRE-Reporting',
27 | values: ['SSM']
28 | }
29 | ]
30 | });
31 |
32 | new CfnMaintenanceWindowTask(this, 'MaintenanceWindowTask', {
33 | taskArn: 'AWS-RunPatchBaseline',
34 | priority: 1,
35 | taskType: 'RUN_COMMAND',
36 | windowId: maintenanceWindow.ref,
37 | name: 'Patch-Task',
38 | targets: [
39 | {
40 | key: 'WindowTargetIds',
41 | values: [maintenanceTarget.ref]
42 | }
43 | ],
44 | taskInvocationParameters: {
45 | maintenanceWindowRunCommandParameters: {
46 | parameters: {
47 | Operation: ['Install']
48 | },
49 | documentVersion: '$LATEST'
50 | }
51 | },
52 | maxErrors: '100%',
53 | maxConcurrency: '1'
54 | });
55 | }
56 | }
57 |
--------------------------------------------------------------------------------
/lib/utils.ts:
--------------------------------------------------------------------------------
1 | import * as codebuild from 'aws-cdk-lib/aws-codebuild';
2 |
3 | export enum BuildImageOS {
4 | LINUX = 'linux',
5 | WINDOWS = 'windows',
6 | MAC = 'mac'
7 | }
8 |
9 | export interface CodeBuildStackArgs {
10 | operatingSystem: string;
11 | arch: string;
12 | amiSearchString: string;
13 | environmentType: codebuild.EnvironmentType;
14 | buildImageOS: BuildImageOS;
15 | }
16 |
17 | export const CODEBUILD_STACKS: CodeBuildStackArgs[] = [
18 | {
19 | operatingSystem: 'ubuntu',
20 | arch: 'x86_64',
21 | amiSearchString: 'ubuntu/images/hvm-ssd/ubuntu*22.04*',
22 | environmentType: codebuild.EnvironmentType.LINUX_EC2,
23 | buildImageOS: BuildImageOS.LINUX
24 | },
25 | {
26 | operatingSystem: 'ubuntu',
27 | arch: 'arm64',
28 | amiSearchString: 'ubuntu/images/hvm-ssd/ubuntu*22.04*',
29 | environmentType: codebuild.EnvironmentType.ARM_EC2,
30 | buildImageOS: BuildImageOS.LINUX
31 | }
32 | ];
33 |
34 | // members of the runfinch org (+dependabot)
35 | // curl -s https://api.github.com/users/ | jq '.id'
36 | // TODO: automate fetching account ID's
37 | export const GITHUB_ALLOWLISTED_ACCOUNT_IDS = [
38 | '47769978', // coderbirju
39 | '424987', // pendo324
40 | '55906459', // austinvazquez
41 | '2304727', // Kern--
42 | '2967759', // henry118
43 | '47723536', // Shubhranshu153
44 | '55555210', // sondavidb
45 | '5525370', // swagatbora90
46 | '59450965', // cezar-r
47 | '49699333' // dependabot[bot] github app
48 | ];
49 |
50 | /**
51 | * Replaces all underscores with hyphens in a string.
52 | * Used for making strings compatible with stack names, which don't allow "_" in the name.
53 | *
54 | * @param name The string to process
55 | * @returns A new string with all underscores replaced by hyphens
56 | */
57 | export const toStackName = (name: string) => {
58 | return name.replace(/_/g, '-');
59 | };
60 |
61 | // @ts-expect-error Extending private class
62 | export class LinuxAMIBuildImage extends codebuild.LinuxBuildImage implements codebuild.IBuildImage {
63 | declare type: codebuild.EnvironmentType;
64 |
65 | constructor(imageId: string, environmentType: codebuild.EnvironmentType) {
66 | // @ts-expect-error Extending private class
67 | super({ imageId });
68 | this.type = environmentType;
69 | }
70 | }
71 |
72 | // @ts-expect-error Extending private class
73 | export class WindowsAMIBuildImage extends codebuild.WindowsBuildImage implements codebuild.IBuildImage {
74 | declare type: codebuild.EnvironmentType;
75 |
76 | constructor(imageId: string, environmentType: codebuild.EnvironmentType) {
77 | // @ts-expect-error Extending private class
78 | super({ imageId });
79 | this.type = environmentType;
80 | }
81 | }
82 |
83 | // @ts-expect-error Extending private class
84 | export class MacAMIBuildImage extends codebuild.LinuxBuildImage implements codebuild.IBuildImage {
85 | declare type: codebuild.EnvironmentType;
86 |
87 | constructor(imageId: string, environmentType: codebuild.EnvironmentType) {
88 | // @ts-expect-error Extending private class
89 | super({ imageId });
90 | this.type = environmentType;
91 | }
92 | }
93 |
--------------------------------------------------------------------------------
/package.json:
--------------------------------------------------------------------------------
1 | {
2 | "name": "finch-aws-cdk",
3 | "version": "0.1.0",
4 | "bin": {
5 | "finch-aws-cdk": "bin/finch-aws-cdk.js"
6 | },
7 | "scripts": {
8 | "build": "tsc",
9 | "watch": "tsc -w",
10 | "test": "jest -c ./jest.config.unit.js",
11 | "integration": "jest -c ./jest.config.integration.js",
12 | "cdk": "cdk",
13 | "prettier-format": "prettier --config .prettierrc --write 'lib/*.ts' 'bin/*.ts' 'test/*.ts' 'integration_test/*.ts' 'config/*.ts'"
14 | },
15 | "devDependencies": {
16 | "@tsconfig/node18": "^18.2.4",
17 | "@types/jest": "^29.5.14",
18 | "@types/node": "^22.15.30",
19 | "@types/prettier": "3.0.0",
20 | "aws-cdk": "^2.1018.1",
21 | "jest": "^29.7.0",
22 | "prettier": "^3.5.3",
23 | "ts-jest": "^29.4.0",
24 | "ts-node": "^10.9.2",
25 | "typescript": "^5.8.3"
26 | },
27 | "dependencies": {
28 | "aws-cdk-lib": "^2.201.0",
29 | "axios": "^1.10.0",
30 | "constructs": "^10.4.2",
31 | "source-map-support": "^0.5.21"
32 | }
33 | }
34 |
--------------------------------------------------------------------------------
/scripts/setup-linux-runner.sh:
--------------------------------------------------------------------------------
1 | #!/usr/bin/bash
2 | set -ex
3 |
4 | # The user data script is run as root so do not use sudo command
5 |
6 | # Log output
7 | exec &> >(tee /var/log/setup-runner.log)
8 | echo $0
9 |
10 | # load all variables from /etc/os-release prefixed with OS_RELEASE as to not clobber
11 | OS_RELEASE_PREFIX="OS_RELEASE"
12 | source <(sed -Ee "s/^([^#])/${OS_RELEASE_PREFIX}_\1/" "/etc/os-release")
13 |
14 | # set variables to make accessing values in /etc/os-release easier
15 | eval "OS_NAME=\"\${${OS_RELEASE_PREFIX}_NAME}\""
16 | eval "OS_VERSION=\"\${${OS_RELEASE_PREFIX}_VERSION_ID}\""
17 |
18 | # configure download parameters based on architecture
19 | UNAME_MACHINE="$(/usr/bin/uname -m)"
20 | if [ "${UNAME_MACHINE}" = "aarch64" ]; then
21 | GH_RUNNER_ARCH="arm64"
22 | NODE_DOWNLOAD_ARCH="arm64"
23 | GH_RUNNER_DOWNLOAD_HASH="a96b0cec7b0237ca5e4210982368c6f7d8c2ab1e5f6b2604c1ccede9cedcb143"
24 | else
25 | GH_RUNNER_ARCH="x64"
26 | NODE_DOWNLOAD_ARCH="x86_64"
27 | GH_RUNNER_DOWNLOAD_HASH="b13b784808359f31bc79b08a191f5f83757852957dd8fe3dbfcc38202ccf5768"
28 | fi
29 |
30 | if [ "${OS_NAME}" = "Amazon Linux" ]; then
31 | USERNAME="ec2-user"
32 | DISTRO="amazonlinux"
33 | BASE_PACKAGES="golang zlib-static containerd nerdctl cni-plugins iptables"
34 | if [ "${OS_VERSION}" = "2" ]; then
35 | GH_RUNNER_DEPENDENCIES="openssl krb5-libs zlib jq"
36 | ADDITIONAL_PACKAGES="policycoreutils-python systemd-rpm-macros inotify-tools ${GH_RUNNER_DEPENDENCIES}"
37 | NODE_VERSION="21.2.0"
38 | curl -OL "https://d3rnber7ry90et.cloudfront.net/linux-${NODE_DOWNLOAD_ARCH}/node-v${NODE_VERSION}.tar.gz"
39 | tar -xf node-v${NODE_VERSION}.tar.gz
40 | mv node-v${NODE_VERSION}/bin/* /usr/bin
41 | # enable EPEL repos, required to install inotify-tools package
42 | amazon-linux-extras install epel -y
43 | elif [ "${OS_VERSION}" = "2023" ]; then
44 | GH_RUNNER_DEPENDENCIES="lttng-ust openssl-libs krb5-libs zlib libicu"
45 | ADDITIONAL_PACKAGES="policycoreutils-python-utils ${GH_RUNNER_DEPENDENCIES}"
46 | fi
47 | fi
48 |
49 | HOMEDIR="/home/${USERNAME}"
50 | RUNNER_DIR="${HOMEDIR}/ar"
51 | mkdir -p "${RUNNER_DIR}" && cd "${HOMEDIR}"
52 |
53 | # TODO: add check for non-Fedora based systems if needed
54 | yum upgrade -y
55 | yum group install -y "Development Tools"
56 | # build dependencies for packages
57 | # this sometimes fails on Amazon Linux 2023, so retry if necessary
58 | for i in {1..2}; do
59 | yum install -y ${BASE_PACKAGES} ${ADDITIONAL_PACKAGES} && break || sleep 5
60 | done
61 |
62 | # start containerd
63 | systemctl enable --now containerd
64 |
65 | GH_RUNNER_VERSION="2.322.0"
66 | GH_RUNNER_FILENAME="actions-runner-linux-${GH_RUNNER_ARCH}-${GH_RUNNER_VERSION}.tar.gz"
67 | GH_RUNNER_DOWNLOAD_URL="https://github.com/actions/runner/releases/download/v${GH_RUNNER_VERSION}/${GH_RUNNER_FILENAME}"
68 |
69 | curl -OL "${GH_RUNNER_DOWNLOAD_URL}"
70 | echo "${GH_RUNNER_DOWNLOAD_HASH} ${GH_RUNNER_FILENAME}" | sha256sum -c
71 | tar -C "${RUNNER_DIR}" -xzf "./${GH_RUNNER_FILENAME}"
72 | chown -R "${USERNAME}:${USERNAME}" "${RUNNER_DIR}"
73 | rm "${GH_RUNNER_FILENAME}"
74 |
75 | # TODO: install SSM agent on non-AL hosts if needed
76 |
77 | # Get GH API key and fetch a runner registration token
78 | GH_KEY=$(aws secretsmanager get-secret-value --secret-id $REPO-runner-reg-key --region $REGION | jq '.SecretString' -r)
79 | RUNNER_REG_TOKEN=$(curl -L -s \
80 | -X POST \
81 | -H "Accept: application/vnd.github+json" \
82 | -H "Authorization: Bearer $GH_KEY" \
83 | -H "X-GitHub-Api-Version: 2022-11-28" \
84 | "https://api.github.com/repos/runfinch/${REPO}/actions/runners/registration-token" | jq -r '.token')
85 |
86 | if [ -z ${GH_RUNNER_DEPENDENCIES+x} ]; then
87 | echo "Executing installdependencies.sh because GH_RUNNER_DEPENDENCIES is not defined."
88 | "${RUNNER_DIR}/bin/installdependencies.sh"
89 | fi
90 |
91 | # Patch runsvc.sh to use previously downloaded version of Node unless its already patched.
92 | # This needs to be run as part of the systemd service since the runner can auto-update
93 | # and we want to patch every time there's an update, not just the initial installation.
94 | if [ "${OS_NAME}" = "Amazon Linux" ] && [ "${OS_VERSION}" = "2" ]; then
95 | RUNNER_SERVICE_NAME="actions.runner.runfinch-finch.$(hostname | cut -d. -f1).service"
96 | RUNNER_SERVICE_DROPIN_DIR="/etc/systemd/system/${RUNNER_SERVICE_NAME}.d"
97 | RUNNER_SERVICE_DROPIN_FILE="/etc/systemd/system/${RUNNER_SERVICE_NAME}.d/replace-node.conf"
98 |
99 | RUNNER_PATCH_SCRIPT="${HOMEDIR}/replace-node.sh"
100 | RUNSVC_PATH="${RUNNER_DIR}/runsvc.sh"
101 | ORIGINAL_NODE_PATH="./externals/\\\$nodever/bin/node"
102 | SYSTEM_NODE_PATH="/usr/bin/node"
103 |
104 | # Create a systemd service that will fix the node paths whenever a new node version is added.
105 | # This may happen if the actions runner service autoupdates, but does not restart the systemctl service
106 | # (meaning it does not re-trigger the ExecStartPre command which is inserted via our dropin unit).
107 | WATCHER_UNIT_NAME="/etc/systemd/system/fix-actions-runner-node.service"
108 | WATCHER_SCRIPT="${HOMEDIR}/watcher.sh"
109 |
110 | cat > "${RUNNER_PATCH_SCRIPT}" << EOF
111 | #!/usr/bin/bash
112 | if grep -q "${ORIGINAL_NODE_PATH}" "${RUNSVC_PATH}"; then
113 | sed -e "s|${ORIGINAL_NODE_PATH}|${SYSTEM_NODE_PATH}|g" -i "${RUNSVC_PATH}"
114 | fi
115 |
116 | # replace any bundled node binary with a symlink to system node
117 | find "${RUNNER_DIR}" -wholename "${RUNNER_DIR}/externals*/node*/bin/node" | while read line; do
118 | rm -rf \$line
119 | ln -s ${SYSTEM_NODE_PATH} \$line
120 | done
121 |
122 | EOF
123 |
124 | chmod +x "${RUNNER_PATCH_SCRIPT}"
125 |
126 | mkdir -p "${RUNNER_SERVICE_DROPIN_DIR}"
127 | cat > "${RUNNER_SERVICE_DROPIN_FILE}" << EOF
128 | [Service]
129 | ExecStartPre=${RUNNER_PATCH_SCRIPT}
130 | EOF
131 |
132 | # Monitor the $RUNNER_DIR for all file changes. This cannot be scoped down
133 | # because inotifywait does not take a file glob itself, and the externals directory
134 | # can be suffixed with version numbers (e.g. externals.someversion, not just one externals dir).
135 | cat > "${WATCHER_SCRIPT}" << EOF
136 | #!/usr/bin/bash
137 | inotifywait -mr "${RUNNER_DIR}" -e create -e moved_to |
138 | while read -r directory action file; do
139 | path="\${directory}\${file}"
140 | if [[ ! "\$path" =~ .*externals.*\/node.* ]]; then
141 | echo 'no match for file \${path}, skipping' | systemd-cat -t "node-patcher" -p info
142 | continue
143 | fi
144 | if [[ "\$(readlink -e ${SYSTEM_NODE_PATH})" == "\$(readlink -e \$file)" ]]; then
145 | # file is already linked properly, skip
146 | echo "file \${path} already linked properly, skipping" | systemd-cat -t "node-patcher" -p info
147 | continue
148 | fi
149 |
150 | echo 'updating node path, triggered by \${path}' | systemd-cat -t "node-patcher" -p info
151 |
152 | "${RUNNER_PATCH_SCRIPT}"
153 | done
154 | EOF
155 |
156 | chmod +x "${WATCHER_SCRIPT}"
157 |
158 | cat > "${WATCHER_UNIT_NAME}" << EOF
159 | [Service]
160 | ExecStart=${WATCHER_SCRIPT}
161 |
162 | [Unit]
163 | Description=GitHub Actions runner node version watcher
164 |
165 | [Install]
166 | WantedBy=multi-user.target
167 | EOF
168 |
169 | systemctl daemon-reload
170 | systemctl enable --now "${WATCHER_UNIT_NAME}"
171 | fi
172 |
173 | # Configure the runner with the registration token, launch the service
174 | # these commands must NOT be run as root
175 | sudo -i -u "${USERNAME}" bash < /Users/ec2-user/setup-runner.log
4 |
5 | echo $0
6 |
7 | # Set up the environment
8 | HOMEDIR="/Users/ec2-user"
9 | RUNNER_DIR="$HOMEDIR/ar"
10 | mkdir -p $RUNNER_DIR && cd $RUNNER_DIR
11 |
12 | # Configure brew path
13 | # Adding to .zshenv so that it will load even in non-interactive/login shells
14 | UNAME_MACHINE="$(/usr/bin/uname -m)"
15 | if [[ "${UNAME_MACHINE}" == "arm64" ]]
16 | then
17 | HOMEBREW_PREFIX="/opt/homebrew"
18 | else
19 | HOMEBREW_PREFIX="/usr/local"
20 | fi
21 | (echo; echo 'eval "$('"${HOMEBREW_PREFIX}"'/bin/brew shellenv)"') >> $HOMEDIR/.zshenv
22 |
23 | # Setup current shell
24 | PATH="/opt/homebrew/bin:/opt/homebrew/sbin:$PATH"
25 |
26 | # Download and setup the runner
27 | if [ $(arch) == "arm64" ]
28 | then
29 | LABEL_ARCH="arm64"
30 | curl -o actions-runner-osx-arm64-2.303.0.tar.gz -L https://github.com/actions/runner/releases/download/v2.303.0/actions-runner-osx-arm64-2.303.0.tar.gz
31 | echo "bbbac8011066b6cec93deb2365132b082b92287baaf34b5d9539e955ffe450ff actions-runner-osx-arm64-2.303.0.tar.gz" | shasum -a 256 -c
32 | # Extract the installer
33 | tar xzf ./actions-runner-osx-arm64-2.303.0.tar.gz
34 | else
35 | LABEL_ARCH="amd64"
36 | curl -o actions-runner-osx-x64-2.303.0.tar.gz -L https://github.com/actions/runner/releases/download/v2.303.0/actions-runner-osx-x64-2.303.0.tar.gz
37 | echo "8bd595568ceee5eb25576972bc8075b47c149b3fac7eb7873deed67944b45739 actions-runner-osx-x64-2.303.0.tar.gz" | shasum -a 256 -c
38 | # Extract the installer
39 | tar xzf ./actions-runner-osx-x64-2.303.0.tar.gz
40 | fi
41 |
42 | # Get GH API key and fetch a runner registration token
43 | su ec2-user -c 'brew install jq'
44 | GH_KEY=$(su ec2-user -c "aws secretsmanager get-secret-value --secret-id $REPO-runner-reg-key --region $REGION" | su ec2-user -c "jq '.SecretString' -r")
45 | LABEL_VER=$(sw_vers -productVersion | cut -d '.' -f 1)
46 | RUNNER_REG_TOKEN=$(curl -L -s \
47 | -X POST \
48 | -H "Accept: application/vnd.github+json" \
49 | -H "Authorization: Bearer $GH_KEY"\
50 | -H "X-GitHub-Api-Version: 2022-11-28" \
51 | https://api.github.com/repos/runfinch/$REPO/actions/runners/registration-token | su ec2-user -c "jq -r '.token'")
52 |
53 | # Configure the runner with the registration token, launch the service
54 | su - ec2-user -c "cd $RUNNER_DIR && ./config.sh --url https://github.com/runfinch/$REPO --unattended --token $RUNNER_REG_TOKEN --work _work --labels '$LABEL_ARCH,$LABEL_VER,$LABEL_STAGE'"
55 | su - ec2-user -c "cd $RUNNER_DIR && ./svc.sh install"
56 | PLIST_NAME="actions.runner.runfinch-$REPO.$(hostname | cut -d '.' -f 1).plist"
57 | cp /Users/ec2-user/Library/LaunchAgents/$PLIST_NAME /Library/LaunchDaemons
58 | /bin/launchctl load /Library/LaunchDaemons/$PLIST_NAME
59 |
--------------------------------------------------------------------------------
/scripts/windows-runner-user-data.yaml:
--------------------------------------------------------------------------------
1 | # windows-runner-user-data.yaml
2 | #
3 | # User Script for launching a Windows EC2 instance that:
4 | # - logs to C:\UserData.log
5 | # - installs git, Make, AWS tools, latest powershell, Nuget, yq and Carbon
6 | # - installs WSL2 and its dependencies
7 | # * reboots the instance to apply the installation
8 | # - periodically updates WSL2
9 | # - registers as a self-hosted GitHub Actions runner on instance startup
10 | version: 1.0
11 | tasks:
12 | - task: executeScript
13 | inputs:
14 | - frequency: once
15 | type: powershell
16 | runAs: admin
17 | content: |-
18 | Start-Transcript -Path "C:\UserData.log" -Append
19 | $progressPreference = 'silentlyContinue'
20 | $RUNNER_DIR="C:\actions-runner"
21 |
22 | # "" values set in lib/asg-runner-stack.ts
23 | $LABEL_ARCH="amd64"
24 | $LABEL_STAGE=""
25 | $REPO=""
26 | $REGION=""
27 |
28 | Write-Information "Installing latest powershell7 version..."
29 | Invoke-Expression "& { $(Invoke-RestMethod 'https://aka.ms/install-powershell.ps1') } -useMSI -EnablePSRemoting -Quiet"
30 |
31 | New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\Program Files\PowerShell\7\pwsh.exe" -PropertyType String -Force
32 |
33 | New-Item -Path $Profile -ItemType File -Force
34 | 'Set-PSReadLineOption -EditMode Emacs' | Out-File -Append $Profile
35 |
36 | New-Item -Path $Home\setup -ItemType Directory
37 | New-Item -Path $Home\setup\bin -ItemType Directory
38 | Set-Location $Home\setup
39 |
40 | Write-Information "Install dependencies git, make, go, AWS tools, NuGet and update path..."
41 |
42 | # Install latest NuGet so that Carbon installation works later
43 | Install-PackageProvider -Name NuGet -Force
44 |
45 | $pws7script = @'
46 | Start-Transcript -Path "$Home\setup\setup7.log" -Append
47 | Import-Module -Name Appx -UseWindowsPowerShell
48 |
49 | # Install git and Make
50 | Invoke-WebRequest -Uri 'https://github.com/git-for-windows/git/releases/download/v2.47.0.windows.2/Git-2.47.0.2-64-bit.exe' -OutFile 'git-2.47.0.2.exe'
51 | .\git-2.47.0.2.exe /SILENT
52 | # use curl to follow redirects
53 | & "C:\Windows\System32\curl.exe" -L https://sourceforge.net/projects/gnuwin32/files/make/3.81/make-3.81.exe/download -o make.exe
54 | .\make.exe /SILENT
55 |
56 | # Install AWS tools
57 | Install-Module -Name AWS.Tools.Common -Force
58 | Install-Module -Name AWS.Tools.SecretsManager -Force
59 | Install-Module -Name AWS.Tools.EC2 -Force
60 | Install-Module -Name AWS.Tools.AutoScaling -Force
61 |
62 | # Install AWS CLI
63 | Invoke-WebRequest -Uri https://awscli.amazonaws.com/AWSCLIV2.msi -OutFile AWSCLIV2.msi
64 | Start-Process msiexec.exe -Wait -ArgumentList '/I AWSCLIV2.msi /quiet'
65 | Remove-Item AWSCLIV2.msi
66 |
67 | # Install Go
68 | Invoke-WebRequest -Uri 'https://go.dev/dl/go1.23.3.windows-amd64.msi' -OutFile 'go1.23.3.windows-amd64.msi'
69 | Start-Process msiexec.exe -Wait -ArgumentList '/I C:\Users\Administrator\setup\go1.23.3.windows-amd64.msi /quiet'
70 |
71 | # Install yq
72 | Invoke-WebRequest -Uri 'https://github.com/mikefarah/yq/releases/download/v4.44.3/yq_windows_amd64.exe' -OutFile '.\bin\yq.exe'
73 |
74 | # Configure path; include path to pre release WSL
75 | $newPath = ("C:\Program Files\Git\bin\;" + "C:\Program Files\Git\usr\bin\;" + "C:\Program Files\WSL\;" + "$env:Path" + ";C:\Program Files\Git\bin\;" + "C:\Program Files (x86)\GnuWin32\bin\;" + "C:\Program Files\Go\bin\;" + "$Home\setup\bin\;" + "C:\Program Files\Amazon\AWSCLIV2\;")
76 | $env:Path = $newPath
77 | # Persist the path to the registry for new shells
78 | Set-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment' -Name PATH -Value $newPath
79 | '@
80 |
81 | # Write PowerShell 7 script to file
82 | $pws7script | Out-File $Home\setup\setup7.ps1
83 |
84 | # Execute script with PowerShell 7
85 | Write-Information "Running setup7.ps1..."
86 | $ConsoleCommand = "$Home\setup\setup7.ps1"
87 | Start-Process "C:\Program Files\PowerShell\7\pwsh" -Wait -NoNewWindow -PassThru -ArgumentList "-Command &{ $ConsoleCommand }"
88 |
89 | Write-Information "Downloading and configuring GitHub Actions Runner..."
90 | mkdir $RUNNER_DIR; cd $RUNNER_DIR
91 | Invoke-WebRequest -Uri https://github.com/actions/runner/releases/download/v2.316.0/actions-runner-win-x64-2.316.0.zip -OutFile actions-runner-win-x64-2.316.0.zip
92 | if((Get-FileHash -Path actions-runner-win-x64-2.316.0.zip -Algorithm SHA256).Hash.ToUpper() -ne '9b2d0443d11ce5c2c4391d708576dc37b1ecf62edcceec7c0c9c8e6b4472b5a1'.ToUpper()){ throw 'Computed checksum did not match' }
93 | Add-Type -AssemblyName System.IO.Compression.FileSystem ; [System.IO.Compression.ZipFile]::ExtractToDirectory("$PWD/actions-runner-win-x64-2.316.0.zip", "$PWD")
94 |
95 | $GH_KEY=(Get-SECSecretValue -SecretId $REPO-runner-reg-key -Region $REGION).SecretString
96 | $LABEL_OS_VER=$([System.Environment]::OSVersion.Version.Major)
97 | $LABEL_BUILD_VER=$([System.Environment]::OSVersion.Version.Build)
98 |
99 | $RUNNER_REG_TOKEN=((Invoke-WebRequest -UseBasicParsing -Method POST -Headers @{"Accept" = "application/vnd.github+json"; "Authorization" = "Bearer $GH_KEY"; "X-GitHub-Api-Version" = "2022-11-28"} -Uri https://api.github.com/repos/runfinch/$REPO/actions/runners/registration-token).Content | ConvertFrom-Json).token
100 |
101 | Write-Information "Starting GitHub Actions Runner..."
102 | cd $RUNNER_DIR; ./config.cmd --url https://github.com/runfinch/$REPO --unattended --runasservice --token $RUNNER_REG_TOKEN --work _work --labels $LABEL_ARCH,$LABEL_OS_VER,$LABEL_BUILD_VER,$LABEL_STAGE
103 |
104 | # To install WSL2, the instance must be rebooted: https://learn.microsoft.com/en-us/windows/wsl/install
105 | # To accomplish this while not replacing the instance in the autoscaling group,
106 | #
107 | # 1. Put the instance in "StandBy" mode
108 | # 2. Register a powershell script to be run at instance reboot on login
109 | # 3. Install WSL2 and restart the instance
110 |
111 | Write-Information "Entering StandBy..."
112 | $InstanceId=(Get-EC2InstanceMetadata -Category InstanceId)
113 | $ASGName=(Get-ASAutoScalingInstance -InstanceId $InstanceId).AutoScalingGroupName
114 | Enter-ASStandby -AutoScalingGroupName $ASGName -InstanceId $InstanceId -ShouldDecrementDesiredCapacity $true
115 |
116 | # Script runs on login after reboot to start GitHub Actions service, put the instance InService in the ASG,
117 | # and update wsl version to pre-release verion such that ssh / session 0 connections can call wsl
118 | # Allow inbound connections on vEthernet interface for traffic from wsl to host
119 | $ServiceName=(Get-Service actions.runner.*).name
120 | $startupscript = @'
121 | Start-Transcript -Path "C:\StartupScript.log" -Append
122 | Invoke-WebRequest -Uri 'https://github.com/microsoft/WSL/releases/download/2.4.13/wsl.2.4.13.0.x64.msi' -OutFile 'C:\Users\Administrator\setup\wsl.2.4.13.0.x64.msi'
123 | Start-Process msiexec.exe -Wait -ArgumentList '/i C:\Users\Administrator\setup\wsl.2.4.13.0.x64.msi /L*V C:\WSLInstallation.log /quiet'
124 | # Update the WSL kernel
125 | Invoke-WebRequest -Uri 'https://wslstorestorage.blob.core.windows.net/wslblob/wsl_update_x64.msi' -OutFile 'C:\Users\Administrator\setup\wsl_update_x64.msi'
126 | Start-Process msiexec.exe -Wait -ArgumentList '/i C:\Users\Administrator\setup\wsl_update_x64.msi /L*V C:\WSLInstallation.log /quiet'
127 | Exit-ASStandby -AutoScalingGroupName $ASGName -InstanceId $InstanceId
128 | Add-MpPreference -ExclusionPath "C:\Users\ADMINI~1\AppData\Local\Temp\go-build*" -Force
129 | Start-Job -ScriptBlock { Start-Process -NoNewWindow -FilePath wsl -ArgumentList '--install Ubuntu' }
130 | sleep 30 # sleep to allow Ubuntu VM to start
131 | New-NetFirewallRule -DisplayName "WSL" -Direction Inbound -InterfaceAlias "vEthernet (WSL)" -Action Allow
132 | '@
133 |
134 | # Write startup powershell script to file.
135 | # $ExecutionContext.InvokeCommand.ExpandString will evaluate variables first, so the ASG and instance ID are specified
136 | Set-Content 'C:\startup.ps1' ($ExecutionContext.InvokeCommand.ExpandString($startupscript))
137 |
138 | # Register a scheduled job to run the script to regist the instance as a runner on boot.
139 | $trigger = New-JobTrigger -AtStartup -RandomDelay 00:00:30
140 | Register-ScheduledJob -Trigger $trigger -FilePath C:\startup.ps1 -Name startup-job-inservice
141 |
142 | Write-Information "Changing GHA service ownership to Administrator..."
143 | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
144 | Install-Module -Name 'Carbon' -AllowClobber -Force
145 | # Configure the GitHub Actions runner service to log on as Administrator; grant the Administrator
146 | # user "Log on as a Service" privileges via Carbon module:
147 | # https://get-carbon.org/Grant-Privilege.html
148 | Stop-Service "actions.runner.*"
149 | Grant-CPrivilege -Identity "Administrator" "SeServiceLogonRight"
150 |
151 | net user Administrator "$GH_KEY"
152 |
153 | Write-Information "starting GHA service..."
154 | Set-Service -Name $ServiceName -StartupType Automatic
155 | Start-Service "actions.runner.*"
156 |
157 | Invoke-Expression "cmd.exe /c sc config $ServiceName obj= '$(hostname)\Administrator' password= '$GH_KEY' type= own"
158 |
159 | wsl --install
160 |
161 | Write-Information "Restarting instance..."
162 | Restart-Computer
163 |
--------------------------------------------------------------------------------
/test/artifact-bucket-cloudfront.test.ts:
--------------------------------------------------------------------------------
1 | import * as cdk from 'aws-cdk-lib';
2 | import { Match, Template } from 'aws-cdk-lib/assertions';
3 | import { ArtifactBucketCloudfrontStack } from '../lib/artifact-bucket-cloudfront';
4 |
5 | describe('ArtifactBucketCloudfrontStack', () => {
6 | test('synthesizes the way we expect', () => {
7 | const app = new cdk.App();
8 | const cloudfront = new ArtifactBucketCloudfrontStack(app, 'CloudfrontStack', 'test');
9 |
10 | // prepare the ArtifactBucketCloudfrontStack template for assertions
11 | const template = Template.fromStack(cloudfront);
12 |
13 | // assert it creates the s3 bucket
14 | template.resourceCountIs('AWS::S3::Bucket', 1);
15 | template.hasResource('AWS::S3::Bucket', {
16 | Properties: {
17 | BucketName: Match.anyValue(),
18 | PublicAccessBlockConfiguration: {
19 | BlockPublicAcls: true,
20 | BlockPublicPolicy: true,
21 | IgnorePublicAcls: true,
22 | RestrictPublicBuckets: true
23 | }
24 | },
25 | UpdateReplacePolicy: 'Retain',
26 | DeletionPolicy: 'Retain'
27 | });
28 |
29 | // assert it creates the cloudfront distribution
30 | template.resourceCountIs('AWS::CloudFront::Distribution', 1);
31 |
32 | expect(cloudfront.terminationProtection).toBeTruthy();
33 | });
34 | });
35 |
--------------------------------------------------------------------------------
/test/asg-runner-stack.test.ts:
--------------------------------------------------------------------------------
1 | import * as cdk from 'aws-cdk-lib';
2 | import { Template } from 'aws-cdk-lib/assertions';
3 | import { PlatformType, RunnerConfig, RunnerType } from '../config/runner-config';
4 | import { ASGRunnerStack } from '../lib/asg-runner-stack';
5 | import { ENVIRONMENT_STAGE } from '../lib/finch-pipeline-app-stage';
6 |
7 | const generateASGStackName = (runnerType: RunnerType) =>
8 | `ASG-${runnerType.platform}-${runnerType.repo}-${runnerType.version.split('.')[0]}-${runnerType.arch}Stack`;
9 |
10 | describe('ASGRunnerStack test', () => {
11 | const app = new cdk.App();
12 | const runnerConfig = RunnerConfig.runnerProd;
13 | const stacks: ASGRunnerStack[] = [];
14 | runnerConfig.runnerTypes.forEach((runnerType) => {
15 | const ASGStackName = generateASGStackName(runnerType);
16 | const licenseArn =
17 | runnerType.platform === PlatformType.WINDOWS ? runnerConfig.windowsLicenseArn : runnerConfig.macLicenseArn;
18 | stacks.push(
19 | new ASGRunnerStack(app, ASGStackName, {
20 | env: {
21 | account: '123456789012',
22 | region: 'us-east-1'
23 | },
24 | stage: ENVIRONMENT_STAGE.Prod,
25 | licenseArn: licenseArn,
26 | type: runnerType
27 | })
28 | );
29 | });
30 | const templates = stacks.map((stack) => Template.fromStack(stack));
31 |
32 | it('should have the correct number of resources', () => {
33 | templates.forEach((template) => {
34 | template.resourceCountIs('AWS::AutoScaling::AutoScalingGroup', 1);
35 | template.resourceCountIs('AWS::EC2::LaunchTemplate', 1);
36 | template.resourceCountIs('AWS::ResourceGroups::Group', 1);
37 | template.resourceCountIs('AWS::EC2::SecurityGroup', 1);
38 | template.resourceCountIs('AWS::IAM::Role', 1);
39 | template.resourceCountIs('AWS::IAM::Policy', 1);
40 | });
41 | });
42 |
43 | it('should match the runner configuration', () => {
44 | expect(stacks.length).toBe(runnerConfig.runnerTypes.length);
45 | runnerConfig.runnerTypes.forEach((type) => {
46 | const stack = stacks.find((stack) => stack.stackName === generateASGStackName(type));
47 | expect(stack).toBeDefined();
48 | const template = Template.fromStack(stack!);
49 | let instanceType = '';
50 | switch (type.platform) {
51 | case PlatformType.WINDOWS: {
52 | instanceType = 'm5zn.metal';
53 | break;
54 | }
55 | case PlatformType.MAC: {
56 | if (type.arch === 'arm') {
57 | instanceType = 'mac2.metal';
58 | } else {
59 | instanceType = 'mac1.metal';
60 | }
61 | break;
62 | }
63 | case PlatformType.AMAZONLINUX: {
64 | if (type.arch === 'arm') {
65 | instanceType = 'c7g.large';
66 | } else {
67 | instanceType = 'c7a.large';
68 | }
69 | break;
70 | }
71 | }
72 | template.hasResourceProperties('AWS::EC2::LaunchTemplate', {
73 | LaunchTemplateData: {
74 | InstanceType: instanceType
75 | }
76 | });
77 | });
78 | });
79 |
80 | it('must have termination protection enabled', () => {
81 | stacks.forEach((stack) => {
82 | expect(stack.terminationProtection).toBeTruthy();
83 | });
84 | });
85 | });
86 |
--------------------------------------------------------------------------------
/test/aspects/stack-termination-protection.test.ts:
--------------------------------------------------------------------------------
1 | // Finch Infrastructure
2 | // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3 |
4 | import { App, Stack } from "aws-cdk-lib";
5 | import { Bucket } from "aws-cdk-lib/aws-s3";
6 | import { applyTerminationProtectionOnStacks } from "../../lib/aspects/stack-termination-protection";
7 |
8 | describe('Stack termination protection aspect', () => {
9 | it('must enable termination protection when applied to a stack and synthesized', () => {
10 | const app = new App();
11 | const stack = new Stack(app, 'FooStack');
12 | // stack needs one resource
13 | new Bucket(stack, 'BarBucket');
14 |
15 | applyTerminationProtectionOnStacks([stack]);
16 | app.synth();
17 |
18 | expect(stack.terminationProtection).toBeTruthy();
19 | });
20 | });
21 |
--------------------------------------------------------------------------------
/test/cloudfront_cdn.test.ts:
--------------------------------------------------------------------------------
1 | import * as cdk from 'aws-cdk-lib';
2 | import { Match, Template } from 'aws-cdk-lib/assertions';
3 | import * as s3 from 'aws-cdk-lib/aws-s3';
4 | import { CfnBucket } from 'aws-cdk-lib/aws-s3';
5 | import { CloudfrontCdn } from '../lib/cloudfront_cdn';
6 |
7 | describe('CloudfrontCdn', () => {
8 | test('synthesizes the way we expect', () => {
9 | const app = new cdk.App();
10 |
11 | // create a stack for CloudfrontCdn to live in
12 | const cloudfrontCdnStack = new cdk.Stack(app, 'CloudfrontCdnStack');
13 | const bucket = new s3.Bucket(cloudfrontCdnStack, 'TestBucket', {
14 | bucketName: 'test-bucket',
15 | publicReadAccess: false,
16 | blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL
17 | });
18 |
19 | // create the CloudfrontCdn stack for assertions
20 | const cloudfrontCdn = new CloudfrontCdn(cloudfrontCdnStack, 'CloudfrontCdn', {
21 | bucket: bucket
22 | });
23 |
24 | const template = Template.fromStack(cloudfrontCdnStack);
25 |
26 | // assert it creates the s3 bucket
27 | template.resourceCountIs('AWS::S3::Bucket', 1);
28 | template.hasResource('AWS::S3::Bucket', {
29 | Properties: {
30 | BucketName: 'test-bucket',
31 | PublicAccessBlockConfiguration: {
32 | BlockPublicAcls: true,
33 | BlockPublicPolicy: true,
34 | IgnorePublicAcls: true,
35 | RestrictPublicBuckets: true
36 | }
37 | },
38 | UpdateReplacePolicy: 'Retain',
39 | DeletionPolicy: 'Retain'
40 | });
41 |
42 | const bukcetLogicalId = cloudfrontCdnStack.getLogicalId(bucket.node.defaultChild as CfnBucket);
43 | // assert the bucket policy
44 | template.hasResourceProperties('AWS::S3::BucketPolicy', {
45 | Bucket: {
46 | Ref: bukcetLogicalId
47 | },
48 | PolicyDocument: {
49 | Statement: [
50 | Match.objectLike({
51 | Action: 's3:GetObject',
52 | Effect: 'Allow',
53 | Principal: {
54 | CanonicalUser: {
55 | 'Fn::GetAtt': [Match.anyValue(), 'S3CanonicalUserId']
56 | }
57 | },
58 | Resource: {
59 | 'Fn::Join': [
60 | '',
61 | [
62 | {
63 | 'Fn::GetAtt': [bukcetLogicalId, 'Arn']
64 | },
65 | '/*'
66 | ]
67 | ]
68 | }
69 | })
70 | ],
71 | Version: '2012-10-17'
72 | }
73 | });
74 |
75 | // assert it creates the cloudfront distribution
76 | template.resourceCountIs('AWS::CloudFront::Distribution', 1);
77 | // the cloufront has a s3 origin and OAI to access the s3 bucket
78 | template.hasResourceProperties('AWS::CloudFront::Distribution', {
79 | DistributionConfig: {
80 | DefaultCacheBehavior: {
81 | AllowedMethods: ['GET', 'HEAD']
82 | },
83 | Origins: [
84 | {
85 | DomainName: {
86 | 'Fn::GetAtt': [Match.anyValue(), 'RegionalDomainName']
87 | },
88 | Id: Match.anyValue(),
89 | S3OriginConfig: {
90 | OriginAccessIdentity: {
91 | 'Fn::Join': [
92 | '',
93 | [
94 | 'origin-access-identity/cloudfront/',
95 | {
96 | Ref: Match.anyValue()
97 | }
98 | ]
99 | ]
100 | }
101 | }
102 | }
103 | ]
104 | }
105 | });
106 |
107 | template.hasResourceProperties('AWS::CloudFront::CloudFrontOriginAccessIdentity', {
108 | CloudFrontOriginAccessIdentityConfig: {
109 | Comment: 'OAI for artifact bucket cloudfront'
110 | }
111 | });
112 | });
113 | });
114 |
--------------------------------------------------------------------------------
/test/codebuild-stack.test.ts:
--------------------------------------------------------------------------------
1 | import * as cdk from 'aws-cdk-lib';
2 | import { Match, Template } from 'aws-cdk-lib/assertions';
3 | import * as codebuild from 'aws-cdk-lib/aws-codebuild';
4 | import { CodeBuildStack } from '../lib/codebuild-stack';
5 |
6 | import { BuildImageOS, CODEBUILD_STACKS, CodeBuildStackArgs, toStackName } from '../lib/utils';
7 |
8 | describe('CodeBuildStack', () => {
9 | test('synthesizes the way we expect', () => {
10 | const app = new cdk.App();
11 | const codebuildStackArgs: CodeBuildStackArgs = {
12 | operatingSystem: 'ubuntu',
13 | arch: 'x86_64',
14 | amiSearchString: 'ubuntu*22.04*',
15 | environmentType: codebuild.EnvironmentType.LINUX_EC2,
16 | buildImageOS: BuildImageOS.LINUX
17 | };
18 |
19 | const stack = new CodeBuildStack(app, 'TestStack', {
20 | env: {
21 | account: '123456789012',
22 | region: 'us-east-1'
23 | },
24 | projectName: 'test-project',
25 | region: 'us-west-2',
26 | ...codebuildStackArgs
27 | });
28 | const template = Template.fromStack(stack);
29 |
30 | validateTemplate(codebuildStackArgs, template);
31 | });
32 |
33 | test('all codebuild stacks in ./utils synthesize as expected', () => {
34 | for (const codebuildStackArgs of CODEBUILD_STACKS) {
35 | const app = new cdk.App();
36 | const stack = new CodeBuildStack(app, 'TestStack', {
37 | env: {
38 | account: '123456789012',
39 | region: 'us-east-1'
40 | },
41 | projectName: 'test-project',
42 | region: 'us-west-2',
43 | ...codebuildStackArgs
44 | });
45 | const template = Template.fromStack(stack);
46 |
47 | validateTemplate(codebuildStackArgs, template);
48 | }
49 | });
50 | });
51 |
52 | const validateTemplate = (codebuildStack: CodeBuildStackArgs, template: Template) => {
53 | // Assert that the stack creates a Fleet
54 | template.hasResourceProperties('AWS::CodeBuild::Project', {
55 | Name: 'test-project',
56 | Environment: {
57 | Type: codebuildStack.environmentType,
58 | ComputeType: 'BUILD_GENERAL1_MEDIUM',
59 | Image: Match.stringLikeRegexp('ami-1234'),
60 | },
61 | Source: {
62 | Type: 'GITHUB',
63 | Location: 'https://github.com/runfinch/finch.git',
64 | ReportBuildStatus: true
65 | }
66 | });
67 |
68 | // Assert that the stack creates a Fleet
69 | template.hasResourceProperties('AWS::CodeBuild::Fleet', {
70 | BaseCapacity: 1,
71 | ComputeType: 'BUILD_GENERAL1_MEDIUM',
72 | EnvironmentType: codebuildStack.environmentType
73 | });
74 |
75 | // Assert that the stack creates a Fleet service role
76 | template.hasResourceProperties('AWS::IAM::Role', {
77 | ManagedPolicyArns: Match.arrayWith([
78 | {
79 | 'Fn::Join': ['', Match.arrayWith([':iam::aws:policy/AmazonEC2FullAccess'])]
80 | },
81 | {
82 | 'Fn::Join': ['', Match.arrayWith([':iam::aws:policy/AmazonSSMManagedInstanceCore'])]
83 | }
84 | ])
85 | });
86 |
87 | // Assert that the stack creates a KMS key
88 | template.hasResourceProperties('AWS::KMS::Key', {
89 | Description: 'Kms Key to encrypt data-at-rest',
90 | Enabled: true
91 | });
92 |
93 | // Assert that the stack creates a KMS alias
94 | template.hasResourceProperties('AWS::KMS::Alias', {
95 | AliasName: Match.stringLikeRegexp(
96 | `alias/finch-${codebuildStack.operatingSystem}-${toStackName(codebuildStack.arch)}-kms-us-west-2`
97 | )
98 | });
99 |
100 | // Check resource count
101 | template.resourceCountIs('AWS::CodeBuild::Project', 1);
102 | template.resourceCountIs('AWS::CodeBuild::Fleet', 1);
103 | template.resourceCountIs('AWS::KMS::Key', 1);
104 | };
105 |
--------------------------------------------------------------------------------
/test/ecr-repo-stack.test.ts:
--------------------------------------------------------------------------------
1 | import * as cdk from 'aws-cdk-lib';
2 | import { Match, Template } from 'aws-cdk-lib/assertions';
3 | import { ECRRepositoryStack } from '../lib/ecr-repo-stack';
4 |
5 | describe('ECRRepositoryStack', () => {
6 | test('synthesizes the way we expect', () => {
7 | const app = new cdk.App();
8 | const ecrRepo = new ECRRepositoryStack(app, 'ECRRepositoryStack', 'test');
9 |
10 | // prepare the ECRRepositoryStack template for assertions
11 | const template = Template.fromStack(ecrRepo);
12 |
13 | // assert it creates the ecr repo with properties set.
14 | template.resourceCountIs('AWS::ECR::Repository', 1);
15 | template.hasResource('AWS::ECR::Repository', {
16 | Properties: {
17 | RepositoryName: Match.anyValue(),
18 | ImageTagMutability: "IMMUTABLE",
19 | ImageScanningConfiguration: {
20 | ScanOnPush: true,
21 | },
22 | },
23 | });
24 |
25 | expect(ecrRepo.terminationProtection).toBeTruthy();
26 | });
27 | })
28 |
--------------------------------------------------------------------------------
/test/event-bridge-scan-notifs-stack.test.ts:
--------------------------------------------------------------------------------
1 | import * as cdk from 'aws-cdk-lib';
2 | import { Match, Template } from 'aws-cdk-lib/assertions';
3 | import { EventBridgeScanNotifsStack } from '../lib/event-bridge-scan-notifs-stack';
4 |
5 | describe('EventBridgeScanNotifsStack', () => {
6 | test('synthesizes the way we expect', () => {
7 | const app = new cdk.App();
8 | const eventBridgeStack = new EventBridgeScanNotifsStack(app, 'EventBridgeScanNotifsStack', 'test');
9 |
10 | const template = Template.fromStack(eventBridgeStack);
11 |
12 | template.resourceCountIs('AWS::Lambda::Function', 1);
13 | template.hasResource('AWS::Lambda::Function', {
14 | Properties: {
15 | Environment:{
16 | Variables: {
17 | "SNS_ARN": Match.anyValue()
18 | }
19 | },
20 | Runtime: "python3.11",
21 | },
22 | });
23 |
24 | const lambda = template.findResources('AWS::Lambda::Function')
25 | const lambdaLogicalID = Object.keys(lambda)[0]
26 |
27 | template.resourceCountIs('AWS::SNS::Topic', 1);
28 |
29 | template.resourceCountIs('AWS::Events::Rule', 1);
30 | template.hasResource('AWS::Events::Rule', {
31 | Properties: {
32 | EventPattern: {
33 | source: ["aws.inspector2"]
34 | },
35 | State: "ENABLED",
36 | Targets: [
37 | {
38 | "Arn":{
39 | "Fn::GetAtt": [
40 | lambdaLogicalID,
41 | "Arn"
42 | ]
43 | }
44 | }
45 | ],
46 | }
47 | });
48 |
49 | expect(eventBridgeStack.terminationProtection).toBeTruthy();
50 | });
51 | })
52 |
--------------------------------------------------------------------------------
/test/finch-pipeline-stack.test.ts:
--------------------------------------------------------------------------------
1 | import * as cdk from 'aws-cdk-lib';
2 | import { Template } from 'aws-cdk-lib/assertions';
3 | import { EnvConfig } from '../config/env-config';
4 | import { FinchPipelineStack } from '../lib/finch-pipeline-stack';
5 |
6 | describe('FinchPipelineStack', () => {
7 | test('synthesizes the way we expect', () => {
8 | const app = new cdk.App();
9 | const stack = new FinchPipelineStack(app, 'TestPipelineStack', {
10 | env: EnvConfig.envPipeline
11 | });
12 | const template = Template.fromStack(stack);
13 |
14 | // assert that the pipeline has a s3 bucket used to store artifacts, e.g. source code of the infrastructure repo
15 | template.resourceCountIs('AWS::S3::Bucket', 1);
16 | template.hasResource('AWS::S3::Bucket', {
17 | Properties: {
18 | BucketEncryption: {
19 | ServerSideEncryptionConfiguration: [
20 | {
21 | ServerSideEncryptionByDefault: {
22 | SSEAlgorithm: 'aws:kms'
23 | }
24 | }
25 | ]
26 | },
27 | PublicAccessBlockConfiguration: {
28 | BlockPublicAcls: true,
29 | BlockPublicPolicy: true,
30 | IgnorePublicAcls: true,
31 | RestrictPublicBuckets: true
32 | }
33 | },
34 | UpdateReplacePolicy: 'Retain',
35 | DeletionPolicy: 'Retain'
36 | });
37 |
38 | // assert the pipeline role
39 | template.hasResourceProperties('AWS::IAM::Role', {
40 | AssumeRolePolicyDocument: {
41 | Statement: [
42 | {
43 | Action: 'sts:AssumeRole',
44 | Effect: 'Allow',
45 | Principal: {
46 | Service: 'codepipeline.amazonaws.com'
47 | }
48 | }
49 | ],
50 | Version: '2012-10-17'
51 | }
52 | });
53 |
54 | // assert the FinchPipelineStack creates a CodePipeline resource
55 | template.hasResourceProperties('AWS::CodePipeline::Pipeline', {
56 | RoleArn: {
57 | 'Fn::GetAtt': ['FinchPipelineRole198D7E07', 'Arn']
58 | }
59 | });
60 |
61 | expect(stack.terminationProtection).toBeTruthy();
62 | });
63 | });
64 |
--------------------------------------------------------------------------------
/test/ssm-patching-stack.test.ts:
--------------------------------------------------------------------------------
1 | import * as cdk from 'aws-cdk-lib';
2 | import { Template } from 'aws-cdk-lib/assertions';
3 | import { SSMPatchingStack } from '../lib/ssm-patching-stack';
4 |
5 | describe('SSMPatchingStack', () => {
6 | test('synthesizes the way we expect', () => {
7 | const app = new cdk.App();
8 | const ssmPatchingStack = new SSMPatchingStack(app, 'SSMPatchingStack');
9 |
10 | const template = Template.fromStack(ssmPatchingStack);
11 |
12 | template.hasResource('AWS::SSM::MaintenanceWindow', {
13 | Properties: {
14 | AllowUnassociatedTargets: false,
15 | Cutoff: 0,
16 | Duration: 2,
17 | Name: 'Patching-Window',
18 | Schedule: 'cron(0 8 ? * * *)'
19 | }
20 | });
21 |
22 | template.hasResource('AWS::SSM::MaintenanceWindowTarget', {
23 | Properties: {
24 | Name: 'All-Instances-Patch-Target',
25 | ResourceType: 'INSTANCE',
26 | Targets: [
27 | {
28 | Key: 'tag:PVRE-Reporting',
29 | Values: ['SSM']
30 | }
31 | ],
32 | WindowId: {
33 | Ref: 'MaintenanceWindow'
34 | }
35 | }
36 | });
37 |
38 | template.hasResource('AWS::SSM::MaintenanceWindowTask', {
39 | Properties: {
40 | MaxConcurrency: '1',
41 | MaxErrors: '100%',
42 | Name: 'Patch-Task',
43 | Priority: 1,
44 | Targets: [
45 | {
46 | Key: 'WindowTargetIds',
47 | Values: [
48 | {
49 | Ref: 'MaintenanceWindowTarget'
50 | }
51 | ]
52 | }
53 | ],
54 | TaskArn: 'AWS-RunPatchBaseline',
55 | TaskInvocationParameters: {
56 | MaintenanceWindowRunCommandParameters: {
57 | Parameters: {
58 | Operation: ['Install']
59 | },
60 | DocumentVersion: '$LATEST'
61 | }
62 | },
63 | TaskType: 'RUN_COMMAND',
64 | WindowId: {
65 | Ref: 'MaintenanceWindow'
66 | }
67 | }
68 | });
69 |
70 | expect(ssmPatchingStack.terminationProtection).toBeTruthy();
71 | });
72 | });
73 |
--------------------------------------------------------------------------------
/test/utils.test.ts:
--------------------------------------------------------------------------------
1 | import { toStackName } from '../lib/utils';
2 |
3 | describe('toStackName', () => {
4 | test('should return a string with the correct format', () => {
5 | const name = 'CodebuildStack-x86_64_ubuntu';
6 | const expected = 'CodebuildStack-x86-64-ubuntu';
7 | const actual = toStackName(name);
8 | expect(actual).toBe(expected);
9 | });
10 | });
11 |
--------------------------------------------------------------------------------
/tsconfig.json:
--------------------------------------------------------------------------------
1 | {
2 | "extends": "@tsconfig/node18/tsconfig.json",
3 | "compilerOptions": {
4 | "declaration": true,
5 | "noUnusedLocals": false,
6 | "noUnusedParameters": false,
7 | "noImplicitReturns": true,
8 | "noFallthroughCasesInSwitch": false,
9 | "inlineSourceMap": true,
10 | "inlineSources": true,
11 | "experimentalDecorators": true,
12 | "strictPropertyInitialization": false,
13 | "resolveJsonModule": true,
14 | "outDir": "./dist",
15 | },
16 | "exclude": [
17 | "node_modules",
18 | "cdk.out",
19 | "dist",
20 | ]
21 | }
22 |
--------------------------------------------------------------------------------