# packages

pkgId: 86779ab75378e071a0a72df038526b21cee0256c28449bccedb73af19a45dac2
name: python-cdk-common
arch: src
version: 2.0.1010
epoch: 0
release: 1
summary: Common AWS CDK librarys.
url: https://github.com/neilkuan/cdk-common.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-common-2.0.1010-1.src.rpm
checksum_type: sha256
description:
  [![NPM version](https://badge.fury.io/js/cdk-common.svg)](https://badge.fury.io/js/cdk-common)
  [![PyPI version](https://badge.fury.io/py/cdk-common.svg)](https://badge.fury.io/py/cdk-common)
  [![release](https://github.com/neilkuan/cdk-common/actions/workflows/release.yml/badge.svg)](https://github.com/neilkuan/cdk-common/actions/workflows/release.yml)

  ![Downloads](https://img.shields.io/badge/-DOWNLOADS:-brightgreen?color=gray)
  ![npm](https://img.shields.io/npm/dt/cdk-common?label=npm&color=orange)
  ![PyPI](https://img.shields.io/pypi/dm/cdk-common?label=pypi&color=blue)



  This Constructs Library will collection of useful `function` and `class` for AWS CDK.



  ```bash
  Use the npm dist tag to opt in CDKv1 or CDKv2:

  // for CDKv2
  npm install cdk-common
  or
  npm install cdk-common@latest

  // for CDKv1
  npm install cdk-common@cdkv1
  ```

  💡💡💡 please click [here](https://github.com/neilkuan/cdk-common/tree/cdkv1#readme), if you are using aws-cdk v1.x.x version.💡💡💡



  ```python
  import * as cdk from 'aws-cdk-lib';
  import { AWSManagedPolicies } from 'cdk-common';
  import { Construct } from 'constructs';
  const app = new cdk.App();

  const stack = new cdk.Stack(app, 'integ-default', { env });

  export class IntegDefault extends Construct {
    constructor(scope: Construct, id: string ) {
      super(scope, id);

      const role = new iam.Role(this, 'iamrole', {
        assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
      });
      // Use this way.
      role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName(AWSManagedPolicies.AMAZON_SSM_MANAGED_INSTANCE_CORE));

      // Not this way.
      role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'));
    }
  }
  ```


pkgId: 661cd572616cfc0c278f6809352fb1d7f86285964f0fbbb42f3f56b76c11eb4b
name: python-cdk-comprehend-s3olap
arch: src
version: 2.0.527
epoch: 0
release: 1
summary: A constrcut for PII and redaction scenarios with Amazon Comprehend and S3 Object Lambda
url: https://github.com/HsiehShuJeng/cdk-comprehend-s3olap.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-comprehend-s3olap-2.0.527-1.src.rpm
checksum_type: sha256
description:
  [![License](https://img.shields.io/badge/License-Apache%202.0-green)](https://opensource.org/licenses/Apache-2.0) [![Release](https://github.com/HsiehShuJeng/cdk-comprehend-s3olap/actions/workflows/release.yml/badge.svg)](https://github.com/HsiehShuJeng/cdk-comprehend-s3olap/actions/workflows/release.yml) [![npm downloads](https://img.shields.io/npm/dt/cdk-comprehend-s3olap?label=npm%20downloads&style=plastic)](https://img.shields.io/npm/dt/cdk-comprehend-s3olap?label=npm%20downloads&style=plastic) [![pypi downloads](https://img.shields.io/pypi/dm/cdk-comprehend-s3olap?label=pypi%20downloads&style=plastic)](https://img.shields.io/pypi/dm/cdk-comprehend-s3olap?label=pypi%20downloads&style=plastic) [![NuGet downloads](https://img.shields.io/nuget/dt/Comprehend.S3olap?label=NuGet%20downloads&style=plastic)](https://img.shields.io/nuget/dt/Comprehend.S3olap?label=NuGet%20downloads&style=plastic) [![repo languages](https://img.shields.io/github/languages/count/HsiehShuJeng/cdk-comprehend-s3olap?label=repo%20languages&style=plastic)](https://img.shields.io/github/languages/count/HsiehShuJeng/cdk-comprehend-s3olap?label=repo%20languages&style=plastic)

  | npm (JS/TS) | PyPI (Python) | Maven (Java) | Go | NuGet |
  | --- | --- | --- | --- | --- |
  | [Link](https://www.npmjs.com/package/cdk-comprehend-s3olap) | [Link](https://pypi.org/project/cdk_comprehend_s3olap/) | [Link](https://search.maven.org/artifact/io.github.hsiehshujeng/cdk-comprehend-s3olap) | [Link](https://github.com/HsiehShuJeng/cdk-comprehend-s3olap-go) | [Link](https://www.nuget.org/packages/Comprehend.S3olap/) |

  This construct creates the foundation for developers to explore the combination of Amazon S3 Object Lambda and Amazon Comprehend for PII scenarios and it is designed with flexibility, i.e, the developers could tweak arguments via CDK to see how AWS services work and behave.



  * [Serverless Architecture](#serverless-architecture)

    * [Access Control](#access-control)
    * [Redaction](#rerfaction)
  * [Introduction](#introduction)
  * [Example](#example)

    * [Typescript](#typescript)
    * [Python](#python)
    * [Java](#java)
    * [C#](#c)
  * [Some Notes](#some-notes)





  **Data Flow**
  ![image](https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2021/05/07/1-2891.jpg)
  *Ram R. and Austin Q., 2021*
  **Arhictecture**
  ![image](https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2021/05/07/2-2891.jpg)
  *Ram R. and Austin Q., 2021*



  ![image](https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2021/05/07/3-2891.jpg)
  *Ram R. and Austin Q., 2021*
  ![image](https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2021/05/07/4-2891.jpg)
  *Ram R. and Austin Q., 2021*



  The architecture was introduced by **Ram Ramani** and **Austin Quam** and was posted on the AWS Blog as [*Protect PII using Amazon S3 Object Lambda to process and modify data during retrieval*](https://aws.amazon.com/tw/blogs/machine-learning/protect-pii-using-amazon-s3-object-lambda-to-process-and-modify-data-during-retrieval/).
  I converted the architecture into a CDK constrcut for 4 programming languages. With this construct, you could manage the properties of IAM roles, the Lambda functions with Amazon Comprehend, and few for the constrcut.
  Before deploying the construct via the CDK, you could either places the text files, i.e., those for the access control case and redaction case, under a directory with a specific name as the following or just deploying directly yet you need to upload the text files onto the S3 buckets manually yourself. It's all your choie.

  ```bash

  $ cd ${ROOT_DIRECTORY_CDK_APPLICATION}
  $ mkdir -p files/access_control
  $ curl -o survey-results.txt https://raw.githubusercontent.com/aws-samples/amazon-comprehend-examples/master/s3_object_lambda_pii_protection_blog/access-control/survey-results.txt
  $ curl -o innocuous.txt https://raw.githubusercontent.com/aws-samples/amazon-comprehend-examples/master/s3_object_lambda_pii_protection_blog/access-control/innocuous.txt

  $ cd ${ROOT_DIRECTORY_CDK_APPLICATION}
  $ mkdir -p files/redaction
  $ curl -o transcript.txt https://raw.githubusercontent.com/aws-samples/amazon-comprehend-examples/master/s3_object_lambda_pii_protection_blog/redaction/transcript.txt
  ```





  You could also refer to [here](https://github.com/HsiehShuJeng/cdk-comprehend-s3olap/tree/main/src/demo/typescript).

  ```bash
  $ cdk --init language typescript
  $ yarn add cdk-comprehend-s3olap
  ```

  ```python
  import * as cdk from '@aws-cdk/core';
  import { ComprehendS3olab } from 'cdk-comprehend-s3olap';

  class TypescriptStack extends cdk.Stack {
    constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
      super(scope, id, props);
      const s3olab = new ComprehendS3olab(this, 'PiiDemo', {
        adminRedactionLambdaConfig: {
          maskCharacter: ' ',
          unsupportedFileHandling: 'PASS',
        },
        billingRedactionLambdaConfig: {
          maskMode: 'REPLACE_WITH_PII_ENTITY_TYPE',
          piiEntityTypes: 'AGE,DRIVER_ID,IP_ADDRESS,MAC_ADDRESS,PASSPORT_NUMBER,PASSWORD,SSN',
        },
        cusrtSupportRedactionLambdaConfig: {
          maskMode: 'REPLACE_WITH_PII_ENTITY_TYPE',
          piiEntityTypes: ' BANK_ACCOUNT_NUMBER,BANK_ROUTING,CREDIT_DEBIT_CVV,CREDIT_DEBIT_EXPIRY,CREDIT_DEBIT_NUMBER,SSN',
        },
      });

      new cdk.CfnOutput(this, 'OPiiAccessControlLambdaArn', { value: s3olab.piiAccessConrtolLambdaArn });
      new cdk.CfnOutput(this, 'OAdminLambdaArn', { value: s3olab.adminLambdaArn });
      new cdk.CfnOutput(this, 'OBillingLambdaArn', { value: s3olab.billingLambdaArn });
      new cdk.CfnOutput(this, 'OCustomerSupportLambdaArn', { value: s3olab.customerSupportLambdaArn });
      new cdk.CfnOutput(this, 'OS3ObjectLambdaGeneralArn', { value: s3olab.s3objectLambdaAccessControlArn });
      new cdk.CfnOutput(this, 'OS3ObjectLambdaAdminArn', { value: s3olab.s3objectLambdaAdminArn });
      new cdk.CfnOutput(this, 'OS3ObjectLambdaBillingArn', { value: s3olab.s3objectLambdaBillingArn });
      new cdk.CfnOutput(this, 'OS3ObjectLambdaCustomerSupportArn', { value: s3olab.customerSupportLambdaArn });
    }
  }

  const app = new cdk.App();
  new TypescriptStack(app, 'TypescriptStack', {
    stackName: 'Comprehend-S3olap',
  });
  ```



  You could also refer to [here](https://github.com/HsiehShuJeng/cdk-databrew-cicd/tree/main/src/demo/python).

  ```bash

  $ python -m ensurepip --upgrade
  $ python -m pip install --upgrade pip
  $ python -m pip install --upgrade virtualenv

  $ cdk init --language python

  $ source .venv/bin/activate
  $ # add "cdk-comprehend-s3olap==2.0.113" into `setup.py`
  $ python -m pip install --upgrade -r requirements.txt
  ```

  The demonstration sample code of Python can be viewed via the Python tab of this package on the [Constrcut Hub](https://constructs.dev/).



  You could also refer to [here](https://github.com/HsiehShuJeng/cdk-comprehend-s3olap/tree/main/src/demo/java).

  ```bash
  $ cdk init --language java
  $ mvn package # If you include the construct, you need to tweak the test case for Java in order to package with success via Maven.
  ```xml
  .
  .
  <properties>
      <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
      <cdk.version>2.72.1</cdk.version>
      <constrcut.verion>2.0.113</constrcut.verion>
      <junit.version>5.7.1</junit.version>
  </properties>
  .
  .
  <dependencies>
      <!-- AWS Cloud Development Kit -->
      <dependency>
          <groupId>software.amazon.awscdk</groupId>
          <artifactId>core</artifactId>
          <version>${cdk.version}</version>
      </dependency>
      <dependency>
          <groupId>io.github.hsiehshujeng</groupId>
          <artifactId>cdk-comprehend-s3olap</artifactId>
          <version>${constrcut.verion}</version>
      </dependency>
      .
      .
      .
  </dependencies>
  ```

  ```java
  package com.myorg;

  import software.amazon.awscdk.core.CfnOutput;
  import software.amazon.awscdk.core.CfnOutputProps;
  import software.amazon.awscdk.core.Construct;
  import software.amazon.awscdk.core.Stack;
  import software.amazon.awscdk.core.StackProps;
  import io.github.hsiehshujeng.cdk.comprehend.s3olap.RedactionLambdaProps;
  import io.github.hsiehshujeng.cdk.comprehend.s3olap.ComprehendS3olab;
  import io.github.hsiehshujeng.cdk.comprehend.s3olap.ComprehendS3olabProps;

  public class JavaStack extends Stack {
      public JavaStack(final Construct scope, final String id) {
          this(scope, id, null);
      }

      public JavaStack(final Construct scope, final String id, final StackProps props) {
          super(scope, id, props);

          ComprehendS3olab s3olab = new ComprehendS3olab(this, "PiiDemo", ComprehendS3olabProps.builder()
              .adminRedactionLambdaConfig(
                  RedactionLambdaProps.builder()
                      .maskCharacter(" ")
                      .unsupportedFileHandling("PASS").build())
              .billingRedactionLambdaConfig(
                  RedactionLambdaProps.builder()
                      .maskMode("REPLACE_WITH_PII_ENTITY_TYPE")
                      .piiEntityTypes("AGE,DRIVER_ID,IP_ADDRESS,MAC_ADDRESS,PASSPORT_NUMBER,PASSWORD,SSN")
                      .build())
              .cusrtSupportRedactionLambdaConfig(
                  RedactionLambdaProps.builder()
                  .maskMode("REPLACE_WITH_PII_ENTITY_TYPE")
                  .piiEntityTypes("BANK_ACCOUNT_NUMBER,BANK_ROUTING,CREDIT_DEBIT_CVV,CREDIT_DEBIT_EXPIRY,CREDIT_DEBIT_NUMBER,SSN")
                  .build())
              .exampleFileDir("/opt/learning/cdk-comprehend-s3olap/src/demo/java")
              .build()
              );

            new CfnOutput(this, "OPiiAccessControlLambdaArn", CfnOutputProps.builder().value(s3olab.getPiiAccessConrtolLambdaArn()).build());
            new CfnOutput(this, "OAdminLambdaArn", CfnOutputProps.builder().value(s3olab.getAdminLambdaArn()).build());
            new CfnOutput(this, "OBillingLambdaArn", CfnOutputProps.builder().value(s3olab.getBillingLambdaArn()).build());
            new CfnOutput(this, "OCustomerSupportLambdaArn", CfnOutputProps.builder().value(s3olab.getCustomerSupportLambdaArn()).build());
            new CfnOutput(this, "OS3ObjectLambdaGeneralArn", CfnOutputProps.builder().value(s3olab.getS3objectLambdaAccessControlArn()).build());
            new CfnOutput(this, "OS3ObjectLambdaAdminArn", CfnOutputProps.builder().value(s3olab.getS3objectLambdaAdminArn()).build());
            new CfnOutput(this, "OS3ObjectLambdaBillingArn", CfnOutputProps.builder().value(s3olab.getS3objectLambdaBillingArn()).build());
            new CfnOutput(this, "OS3ObjectLambdaCustomerSupportArn", CfnOutputProps.builder().value(s3olab.getCustomerSupportLambdaArn()).build());
      }
  }
  ```



  You could also refer to [here](https://github.com/HsiehShuJeng/cdk-comprehend-s3olap/tree/main/src/demo/csharp).

  ```bash
  $ cdk init --language csharp
  $ dotnet add src/Csharp package Comprehend.S3olap --version 2.0.113
  ```

  ```cs
  using Amazon.CDK;
  using ScottHsieh.Cdk;

  namespace Csharp
  {
      public class CsharpStack : Stack
      {
          internal CsharpStack(Construct scope, string id, IStackProps props = null) : base(scope, id, props)
          {
              var S3olab = new ComprehendS3olab(this, "PiiDemo", new ComprehendS3olabProps
              {
                  AdminRedactionLambdaConfig = new RedactionLambdaProps
                  {
                      MaskCharacter = " ",
                      UnsupportedFileHandling = "PASS"
                  },
                  BillingRedactionLambdaConfig = new RedactionLambdaProps
                  {
                      MaskMode = "REPLACE_WITH_PII_ENTITY_TYPE",
                      PiiEntityTypes = "AGE,DRIVER_ID,IP_ADDRESS,MAC_ADDRESS,PASSPORT_NUMBER,PASSWORD,SSN"
                  },
                  CusrtSupportRedactionLambdaConfig = new RedactionLambdaProps
                  {
                      MaskMode = "REPLACE_WITH_PII_ENTITY_TYPE",
                      PiiEntityTypes = "BANK_ACCOUNT_NUMBER,BANK_ROUTING,CREDIT_DEBIT_CVV,CREDIT_DEBIT_EXPIRY,CREDIT_DEBIT_NUMBER,SSN"
                  },
                  ExampleFileDir = "/opt/learning/cdk-comprehend-s3olap/src/demo/csharp"
              });

              new CfnOutput(this, "OPiiAccessControlLambdaArn", new CfnOutputProps { Value = S3olab.PiiAccessConrtolLambdaArn });
              new CfnOutput(this, "OAdminLambdaArn", new CfnOutputProps { Value = S3olab.AdminLambdaArn });
              new CfnOutput(this, "OBillingLambdaArn", new CfnOutputProps { Value = S3olab.BillingLambdaArn });
              new CfnOutput(this, "OCustomerSupportLambdaArn", new CfnOutputProps { Value = S3olab.CustomerSupportLambdaArn });
              new CfnOutput(this, "OS3ObjectLambdaGeneralArn", new CfnOutputProps { Value = S3olab.S3objectLambdaAccessControlArn });
              new CfnOutput(this, "OS3ObjectLambdaAdminArn", new CfnOutputProps { Value = S3olab.S3objectLambdaAdminArn });
              new CfnOutput(this, "OS3ObjectLambdaBillingArn", new CfnOutputProps { Value = S3olab.S3objectLambdaBillingArn });
              new CfnOutput(this, "OS3ObjectLambdaCustomerSupportArn", new CfnOutputProps { Value = S3olab.CustomerSupportLambdaArn });
          }
      }
  }
  ```



  1. You should see similar items as the following diagram displays after deploying the constrcut.
     ![image](https://raw.githubusercontent.com/HsiehShuJeng/cdk-comprehend-s3olap/main/images/s3olap_console.png)
  2. After creating the foundation with success, you could switch roles that the consrtcut creates for you and see how **Amazon S3 Object Lambda** works. For what switching roles is, please refer to [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-console.html) for the detail.
     ![image](https://raw.githubusercontent.com/HsiehShuJeng/cdk-comprehend-s3olap/main/images/switch_roles.png)
  3. You explore **Amazon S3 Object Lambda** through the Object Lambda access points on the AWS Console and open or download the text files via one of the IAM roles.
  4. Lambda code that incorporates with **Amazon Comprehend** could be see [here](https://github.com/aws-samples/amazon-comprehend-examples/tree/master/s3_object_lambda_pii_protection_blog).


pkgId: 85f3d5249aa04a34bfa85ee3fc6dad371b55e1dbcbacaa2528bd5cf93965f3d1
name: python-cdk-constructs
arch: src
version: 1.9.2
epoch: 0
release: 1
summary: A CDK construct library
url: https://github.com/tm-lcarvalho/cdk-constructs.git
rpm_license: GPL-3.0-or-later
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-constructs-1.9.2-1.src.rpm
checksum_type: sha256
description:
  Welcome to Toumoro's AWS Service Wrapper CDK Construct Library! This library is designed to make it easy and efficient to deploy and manage AWS services within your CDK projects. Whether you're provisioning infrastructure for a simple web application or orchestrating a complex cloud-native architecture, this library aims to streamline your development process by providing high-level constructs for common AWS services.



  * Simplified Service Provisioning: Easily create and configure AWS services using intuitive CDK constructs.
  * Best Practices Built-In: Leverage pre-configured settings and defaults based on AWS best practices to ensure reliable and secure deployments.
  * Modular and Extensible: Compose your infrastructure using modular constructs, allowing for flexibility and reusability across projects.



  [Contributing](CONTRIBUTING.md)



  [Examples](examples/README.md)



  [API](API.md)



  [AWS CDK Design Guidelines](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)



  1. *Prefixes*:

     * *Cfn* for CloudFormation resources.
     * *Fn* for constructs generating CloudFormation functions.
     * *As* for abstract classes.
     * *I* for interfaces.
     * *Vpc* for constructs related to Virtual Private Cloud.
     * *Lambda* for constructs related to AWS Lambda.
     * Example: CfnStack, FnSub, Aspects, IVpc, VpcNetwork, LambdaFunction.
  2. *Construct Names*:

     * Use descriptive names that reflect the purpose of the construct.
     * CamelCase for multi-word names.
     * Avoid abbreviations unless they are widely understood.
     * Example: BucketStack, RestApiConstruct, DatabaseCluster.
  3. *Property Names*:

     * Follow AWS resource naming conventions where applicable.
     * Use camelCase for property names.
     * Use clear and concise names that reflect the purpose of the property.
     * Example: bucketName, vpcId, functionName.
  4. *Method Names*:

     * Use verbs or verb phrases to describe actions performed by methods.
     * Use camelCase.
     * Example: addBucketPolicy, createVpc, invokeLambda.
  5. *Interface Names*:

     * Start with an uppercase I.
     * Use clear and descriptive names.
     * Example: IInstance, ISecurityGroup, IVpc.
  6. *Module Names*:

     * Use lowercase with hyphens for separating words.
     * Be descriptive but concise.
     * Follow a hierarchy if necessary, e.g., aws-cdk.aws_s3 for S3-related constructs.
     * Example: aws-cdk.aws_s3, aws-cdk.aws_ec2, aws-cdk.aws_lambda.
  7. *Variable Names*:

     * Use descriptive names.
     * CamelCase for multi-word names.
     * Keep variable names concise but meaningful.
     * Example: instanceCount, subnetIds, roleArn.
  8. *Enum and Constant Names*:

     * Use uppercase for constants.
     * CamelCase for multi-word names.
     * Be descriptive about the purpose of the constant or enum.
     * Example: MAX_RETRIES, HTTP_STATUS_CODES, VPC_CONFIG.
  9. *File Names*:

     * Use lowercase with hyphens for separating words.
     * Reflect the content of the file.
     * Include version numbers if necessary.
     * Example: s3-bucket-stack.ts, vpc-network.ts, lambda-function.ts.
  10. *Documentation Comments*:

      * Use JSDoc or similar conventions to provide clear documentation for each construct, method, property, etc.
      * Ensure that the documentation is up-to-date and accurately reflects the purpose and usage of the code.


pkgId: aee693c01d0ba0e9a77c05e219a87bec48c703d668fc1c31b32f9d5db62eb70c
name: python-cdk-cr-constructs
arch: src
version: 2.1.597
epoch: 0
release: 1
summary: aws cdk library for custom resource constructs.
url: https://github.com/neilkuan/cdk-cr-constructs.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-cr-constructs-2.1.597-1.src.rpm
checksum_type: sha256
description:
  This Construct is collect custom resource



  ```python
  import { App, Stack, CfnOutput, Duration, aws_iam } from 'aws-cdk-lib';
  import { CustomResourceGetEIP } from 'cdk-cr-constructs';
  const env = {
    region: process.env.CDK_DEFAULT_REGION,
    account: process.env.CDK_DEFAULT_ACCOUNT,
  };
  const app = new App();
  const stack = new Stack(app, 'testing-stack', { env });
  const getIps = new CustomResourceGetEIP(stack, 'CustomResourceGetEIP', {
    /**
     * Discovery us-east-1 Elastic Ips.
     */
    regions: ['us-east-1'],
    /**
     * Add Company Ips.
     */
    companyIps: ['1.2.3.4'],
  });
  const role = new aws_iam.Role(stack, 'DemoRole', {
    assumedBy: new aws_iam.AccountRootPrincipal(),
  });
  /**
   * Example create an assume role, allow all action from ip address.
  */
  role.addToPolicy(new aws_iam.PolicyStatement({
    effect: aws_iam.Effect.ALLOW,
    resources: ['*'],
    actions: ['*'],
    conditions: {
      IpAddress: {
        'aws:SourceIp': getIps.ipList(),
      },
    },
  }));
  ```


pkgId: bcf5e410869097d0c2e6ad6b33569ea761b1e4f71147837af654c49c1897f9c0
name: python-cdk-create-ami
arch: src
version: 0.0.191
epoch: 0
release: 1
summary: cdk-create-ami
url: https://github.com/schuettc/cdk-create-ami.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-create-ami-0.0.191-1.src.rpm
checksum_type: sha256
description:
  ![Experimental](https://img.shields.io/badge/experimental-important.svg?style=for-the-badge)

  An AWS Cloud Development Kit (AWS CDK) construct library that allows you to build an [Amazon EC2](https://aws.amazon.com/ec2/) instance and create an [Amazon Machine Image](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html) from that instance.



  From [Creating an AMI](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html#creating-an-ami):

  > You can launch an instance from an existing AMI, customize the instance (for example, [install software](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/install-software.html) on the instance), and then save this updated configuration as a custom AMI. Instances launched from this new custom AMI include the customizations that you made when you created the AMI.

  This CDK Construct will assist in you creating that AMI for later use.



  To add to your AWS CDK package.json file:

  ```
  yarn add cdk-create-ami
  ```



  To create an image:

  ```python
  import * as ami from 'cdk-create-ami';
  ```

  ```python
  const amiImage = new ami.CreateAMI(this, 'amiImage', {
    instanceId: baseInstance.instanceId,
    deleteAmi: true,
    deleteInstance: true,
    blockDeviceMappings: [
      {
        deviceName: '/dev/sdh',
        ebs: {
          volumeSize: 20,
          volumeType: ami.VolumeType.GP3,
          deleteOnTermination: true,
        },
      },
    ],
    tagSpecifications: [
      {
        resourceType: ami.ResourceType.IMAGE,
        tags: [{ key: 'TagKey', value: 'TagValue' }],
      },
    ],
  });
  ```

  This will take an already created [Instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Instances.html) and convert it to an AMI. This process involves stopping the Instance and then creating the AMI. Besides typical AMI creation options regarding [block device mappings](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/block-device-mapping-concepts.html) and [tags](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html), the AMI can be created with two options:

  ```python
        deleteAmi: true,
        deleteInstance: true,
  ```

  * deleteAmi: When the CDK is destroyed, if this is set to `True`, the AMI will be deleted. Otherwise, the AMI will be retained.
  * deleteInstance: When the CDK is deployed, if this is set to `True`, the base image will be deleted. Otherwise, the instance will be retained in a `Stopped` state.



  The associated exmaple includes two Stacks that can be created.

  * AMIExample - Deploys Instance and creates AMI from Instance
  * InstanceExample - Deploys Instance from previously created AMI



  ```
  cd example
  yarn ami
  ```

  This will deploy an Instance and create an AMI from the created Instance.



  ```python
  const vpc = new VPC(this, 'VPC');
  const baseInstance = new BaseInstance(this, 'Instance', {
    vpc: vpc.vpc,
    securityGroup: vpc.securityGroup,
    ec2Role: vpc.ec2Role,
  });
  ```

  The example will create a VPC and Instance to be used to create the AMI. This instance contains a [cloud-init script](example/resources/base_install.sh):

  ```bash
  HOMEDIR=/home/ec2-user
  yum update -y
  yum install net-tools -y
  yum install wget -y

  TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"`
  LOCAL_HOSTNAME=$( curl -H "X-aws-ec2-metadata-token: $TOKEN" -v http://169.254.169.254/latest/meta-data/public-hostname )
  INSTANCE_ID=$( curl -H "X-aws-ec2-metadata-token: $TOKEN" -v http://169.254.169.254/latest/meta-data/instance-id )

  echo "AMI Hostname: $LOCAL_HOSTNAME" >> /home/ec2-user/config.txt
  echo "AMI InstanceId: $INSTANCE_ID" >> /home/ec2-user/config.txt
  ```

  This will result in a file: `/home/ec2-user/config.txt` that contains the base instance information. This file will be retained in the AMI.

  ```
  AMI Hostname: ec2-54-152-127-245.compute-1.amazonaws.com
  AMI InstanceId: i-002aeb6cdde92c9b5
  ```



  The AMI information will be stored in AWS Systems Manager - Parameter Store

  ![SSM](images/SSM.png)



  Once the AMI has been created, that AMI can be used to create a new Instance that has been pre-configured.

  ```bash
  yarn instance imageId=IMAGEID
  ```

  The IMAGEID to be used is provided as output from the AMI Example Stack.

  This AMI Image ID is retrieved by the CDK:

  ```python
  const customAmi = new ec2.GenericSSMParameterImage(
    '/createAMI/' + props.imageId,
    ec2.OperatingSystemType.LINUX,
  );
  ```

  This AMI Image ID is used to create the new Instance:

  ```python
  const ec2Instance = new ec2.Instance(this, 'Instance', {
    vpc: props.vpc,
    instanceType: ec2.InstanceType.of(
      ec2.InstanceClass.T4G,
      ec2.InstanceSize.MEDIUM,
    ),
    machineImage: customAmi,
    // More Instance configuration here
  });
  ```

  This instance contains a [cloud-init script](example/resources/new_install.sh):

  ```bash
  HOMEDIR=/home/ec2-user

  TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"`
  LOCAL_HOSTNAME=$( curl -H "X-aws-ec2-metadata-token: $TOKEN" -v http://169.254.169.254/latest/meta-data/public-hostname )
  INSTANCE_ID=$( curl -H "X-aws-ec2-metadata-token: $TOKEN" -v http://169.254.169.254/latest/meta-data/instance-id )

  echo "New Instance Hostname: $LOCAL_HOSTNAME" >> /home/ec2-user/config.txt
  echo "New Instance InstanceId: $INSTANCE_ID" >> /home/ec2-user/config.txt
  ```

  Because the Instance used to create the AMI has already updated and installed packages, these do not need to be run again. Instead, the new Instance Hostname and InstanceId will be copied to the existing `/home/ec2-user/config.txt` file.

  ```text
  AMI Hostname: ec2-54-152-127-245.compute-1.amazonaws.com
  AMI InstanceId: i-002aeb6cdde92c9b5
  New Instance Hostname: ec2-54-242-5-47.compute-1.amazonaws.com
  New Instance InstanceId: i-0e67014a77d5d1995
  ```



  See [CONTRIBUTING](CONTRIBUTING.md) for more information.



  This project is licensed under the Apache-2.0 License.


pkgId: d7580773bbd189445271361d81c006d363485cfdc108a0695ee28a343996b896
name: python-cdk-data-zone
arch: src
version: 0.0.0
epoch: 0
release: 1
summary: AWS DataZone L2 Construct library
url: https://github.com/cdklabs/cdk-data-zone.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-data-zone-0.0.0-1.src.rpm
checksum_type: sha256
description:
  <p align="center">
    <a href="https://opensource.org/licenses/Apache-2.0"><img src="https://img.shields.io/badge/License-Apache%202.0-yellowgreen.svg" alt="Apache 2.0 License"></a>
    <a href="https://github.com/cdklabs/cdk-cicd-wrapper/actions/workflows/release.yml"><img src="https://github.com/cdklabs/cdk-data-zone/actions/workflows/release.yml/badge.svg" alt="Release badge"></a>
    <a href="https://vscode.dev/redirect?url=vscode://ms-vscode-remote.remote-containers/cloneInVolume?url=https://github.com/cdklabs/cdk-data-zone"><img src="https://img.shields.io/static/v1?label=Dev%20Containers&message=Open&color=blue" alt="Open in DEV Containers"></a>
  </p>



  **CDK Amazon DataZone** is an AWS CDK construct library that simplifies the creation and management of **Amazon DataZone** resources. This library enables developers to automate data governance, data cataloging, and secure data sharing across domains by using familiar infrastructure-as-code practices with AWS CDK.



  * Easily create and manage Amazon DataZone components, such as Domains, Projects, and Environments.
  * Seamless integration with the AWS CDK ecosystem, allowing users to manage DataZone resources alongside other AWS resources.
  * Support for secure resource configurations like KMS encryption, S3 bucket management, and domain-level blueprinting.



  To install this library, use the following npm command:

  ```bash
  npm install @cdklabs/cdk-data-zone
  ```



  Here’s an example of how to use the **@cdklabs/cdk-data-zone** library in your AWS CDK project:

  ```python
  from aws_cdk import App, RemovalPolicy
  from aws_cdk.aws_kms import Key
  from aws_cdk.aws_s3 import Bucket, BucketEncryption


  app = App()
  stack = Stack(app, "TestStack")


  bucket = Bucket(stack, "BlueprintBucket",
      enforce_sSL=True,
      removal_policy=RemovalPolicy.DESTROY,
      auto_delete_objects=True,
      encryption=BucketEncryption.S3_MANAGED
  )


  domain = Domain(stack, "Domain",
      name="integration",
      encryption_key=Key(stack, "Key", enable_key_rotation=True)
  )


  blueprint = domain.enable_blueprint(BlueprintEnvironmentIdentifiers.DEFAULT_DATA_LAKE,
      parameters={
          "S3Location": f"s3://{bucket.bucketName}"
      }
  )


  project = domain.create_project("test-project",
      name="test-project",
      glossaries=Glossaries.from_file("./resources/glossaries.json"),
      forms=Forms.from_file("./resources/form-metadata.json")
  )


  environment_profile = EnvironmentProfile(stack, "EnvironmentProfile",
      name="dev",
      blueprint=blueprint,
      project=project
  )


  Environment(stack, "environment",
      project=project,
      name="DEV",
      environment_profile=environment_profile
  )

  app.synth()
  ```



  * **Domain Creation**: Easily create Amazon DataZone Domains with encryption and other security features.
  * **Project Management**: Use Blueprints, Forms, and Glossaries to structure data governance.
  * **Environment Profiles**: Manage different environments within your data projects to ensure proper data governance policies.



  This project leverages **Projen** for managing development workflows. Projen automates common tasks like dependency management, testing, and versioning.



  1. **Clone the Repository**:

     ```bash
     git clone https://github.com/cdklabs/cdk-data-zone.git
     cd cdk-data-zone
     ```
  2. **Install Dependencies**:

     ```bash
     npx projen install
     ```
  3. **Run Projen** to synthesize files:

     ```bash
     npx projen
     ```
  4. **Build the Project**:

     ```bash
     npx projen build
     ```
  5. **Run Tests**:

     ```bash
     npx projen test
     ```



  Detailed documentation of the available constructs, their properties, and methods is available in the [API.md](API.md) file.



  Contributions are welcome! Please see the [CONTRIBUTING.md](CONTRIBUTING.md) guide for more details on how to get involved.



  Please see the [SECURITY.md](SECURITY.md) for more information.



  This project is licensed under the **Apache-2.0** License. See the [LICENSE](LICENSE) file for more information.


pkgId: fae1a4a276269164b6f3ce0f96454f95c9c8a1071c51b1b2b028cad5b933e53d
name: python-cdk-databrew-cicd
arch: src
version: 2.0.393
epoch: 0
release: 1
summary: A construct for AWS Glue DataBrew wtih CICD
url: https://github.com/HsiehShuJeng/cdk-databrew-cicd.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-databrew-cicd-2.0.393-1.src.rpm
checksum_type: sha256
description:
  This construct creates a **CodePipeline** pipeline where users can push a **DataBrew** recipe into the **CodeCommit** repository and the recipe will be pushed to a pre-production AWS account and a production AWS account by order automatically.

  | npm (JS/TS) | PyPI (Python) | Maven (Java) | Go | NuGet |
  | --- | --- | --- | --- | --- |
  | [Link](https://www.npmjs.com/package/cdk-databrew-cicd) | [Link](https://pypi.org/project/cdk_databrew_cicd/) | [Link](https://search.maven.org/artifact/io.github.hsiehshujeng/cdk-databrew-cicd) | [Link](https://github.com/HsiehShuJeng/cdk-databrew-cicd-go) | [Link](https://www.nuget.org/packages/Databrew.Cicd/) |

  [![License](https://img.shields.io/badge/License-Apache%202.0-green)](https://opensource.org/licenses/Apache-2.0) [![Release](https://github.com/HsiehShuJeng/cdk-databrew-cicd/workflows/Release/badge.svg)](https://github.com/HsiehShuJeng/cdk-databrew-cicd/actions/workflows/release.yml) [![npm downloads](https://img.shields.io/npm/dt/cdk-databrew-cicd?label=npm%20downloads&style=plastic)](https://img.shields.io/npm/dt/cdk-databrew-cicd?label=npm%20downloads&style=plastic) [![pypi downloads](https://img.shields.io/pypi/dm/cdk-databrew-cicd?label=pypi%20downloads&style=plastic)](https://img.shields.io/pypi/dm/cdk-databrew-cicd?label=pypi%20downloads&style=plastic) [![NuGet downloads](https://img.shields.io/nuget/dt/Databrew.Cicd?label=NuGet%20downloads&style=plastic)](https://img.shields.io/nuget/dt/Databrew.Cicd?label=NuGet%20downloads&style=plastic) [![repo languages](https://img.shields.io/github/languages/count/HsiehShuJeng/cdk-databrew-cicd?label=repo%20languages&style=plastic)](https://img.shields.io/github/languages/count/HsiehShuJeng/cdk-databrew-cicd?label=repo%20languages&style=plastic)



  * [Serverless Architecture](#serverless-architecture)
  * [Introduction](#introduction)
  * [Example](#example)

    * [Typescript](#typescript)
    * [Python](#python)
    * [Java](#java)
    * [C#](#c)
    * [Go](#go)
  * [Some Efforts after Stack Creation](#some-efforts-after-stack-creation)
  * [How Successful Commits Look Like](#how-successful-commits-look-like)



  ![image](https://d2908q01vomqb2.cloudfront.net/b6692ea5df920cad691c20319a6fffd7a4a766b8/2021/05/19/image001.jpg) *Romi B. and Gaurav W., 2021*



  The architecture was introduced by **Romi Boimer** and **Gaurav Wadhawan** and was posted on the AWS Blog as [*Set up CI/CD pipelines for AWS Glue DataBrew using AWS Developer Tools*](https://aws.amazon.com/tw/blogs/big-data/set-up-ci-cd-pipelines-for-aws-glue-databrew-using-aws-developer-tools/).
  I converted the architecture into a CDK construct for 5 programming languages. Before applying the AWS construct, make sure you've set up a proper IAM role for the pre-production and production AWS accounts. You could achieve it either by creating manually or creating through a custom construct in this library.

  ```python
  import { IamRole } from 'cdk-databrew-cicd';

  new IamRole(this, 'AccountIamRole', {
      environment: 'preproduction', // or 'production'
      accountID: 'ACCOUNT_ID',
      // roleName: 'OPTIONAL'
  });
  ```





  You could also refer to [here](https://github.com/HsiehShuJeng/cdk-databrew-cicd/tree/main/src/demo/typescript).

  ```bash
  $ cdk --init language typescript
  $ yarn add cdk-databrew-cicd
  ```

  ```python
  import * as cdk from '@aws-cdk/core';
  import { DataBrewCodePipeline } from 'cdk-databrew-cicd';

  class TypescriptStack extends cdk.Stack {
    constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
      super(scope, id, props);

      const preproductionAccountId = 'PREPRODUCTION_ACCOUNT_ID';
      const productionAccountId = 'PRODUCTION_ACCOUNT_ID';

      const dataBrewPipeline = new DataBrewCodePipeline(this, 'DataBrewCicdPipeline', {
        preproductionIamRoleArn: `arn:${cdk.Aws.PARTITION}:iam::${preproductionAccountId}:role/preproduction-Databrew-Cicd-Role`,
        productionIamRoleArn: `arn:${cdk.Aws.PARTITION}:iam::${productionAccountId}:role/production-Databrew-Cicd-Role`,
        // bucketName: 'OPTIONAL',
        // repoName: 'OPTIONAL',
        // branchName: 'OPTIONAL',
        // pipelineName: 'OPTIONAL'
      });

      new cdk.CfnOutput(this, 'OPreproductionLambdaArn', { value: dataBrewPipeline.preproductionFunctionArn });
      new cdk.CfnOutput(this, 'OProductionLambdaArn', { value: dataBrewPipeline.productionFunctionArn });
      new cdk.CfnOutput(this, 'OCodeCommitRepoArn', { value: dataBrewPipeline.codeCommitRepoArn });
      new cdk.CfnOutput(this, 'OCodePipelineArn', { value: dataBrewPipeline.codePipelineArn });
    }
  }

  const app = new cdk.App();
  new TypescriptStack(app, 'TypescriptStack', {
    stackName: 'DataBrew-CICD'
  });
  ```



  You could also refer to [here](https://github.com/HsiehShuJeng/cdk-databrew-cicd/tree/main/src/demo/python).

  ```bash

  $ python -m ensurepip --upgrade
  $ python -m pip install --upgrade pip
  $ python -m pip install --upgrade virtualenv

  $ cdk init --language python

  $ source .venv/bin/activate
  $ cat <<EOL > requirements.txt
  aws-cdk.core
  cdk-databrew-cicd
  EOL
  $ python -m pip install -r requirements.txt
  ```

  ```python
  from aws_cdk import core as cdk
  from cdk_databrew_cicd import DataBrewCodePipeline

  class PythonStack(cdk.Stack):

      def __init__(self, scope: cdk.Construct, construct_id: str, **kwargs) -> None:
          super().__init__(scope, construct_id, **kwargs)

          preproduction_account_id = "PREPRODUCTION_ACCOUNT_ID"
          production_account_id = "PRODUCTION_ACCOUNT_ID"

          databrew_pipeline = DataBrewCodePipeline(self,
          "DataBrewCicdPipeline",
          preproduction_iam_role_arn=f"arn:{cdk.Aws.PARTITION}:iam::{preproduction_account_id}:role/preproduction-Databrew-Cicd-Role",
          production_iam_role_arn=f"arn:{cdk.Aws.PARTITION}:iam::{production_account_id}:role/preproduction-Databrew-Cicd-Role",
              
              
              
              
              
              )

          cdk.CfnOutput(self, 'OPreproductionLambdaArn', value=databrew_pipeline.preproduction_function_arn)
          cdk.CfnOutput(self, 'OProductionLambdaArn', value=databrew_pipeline.production_function_arn)
          cdk.CfnOutput(self, 'OCodeCommitRepoArn', value=databrew_pipeline.code_commit_repo_arn)
          cdk.CfnOutput(self, 'OCodePipelineArn', value=databrew_pipeline.code_pipeline_arn)
  ```

  ```bash
  $ deactivate
  ```



  You could also refer to [here](https://github.com/HsiehShuJeng/cdk-databrew-cicd/tree/main/src/demo/java).

  ```bash
  $ cdk init --language java
  $ mvn package
  ```

  ```xml
  .
  .
  <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <cdk.version>2.87.0</cdk.version>
        <constrcut.verion>2.0.196</constrcut.verion>
        <junit.version>5.7.1</junit.version>
  </properties>
   .
   .
   <dependencies>
       <!-- AWS Cloud Development Kit -->
        <dependency>
              <groupId>software.amazon.awscdk</groupId>
              <artifactId>aws-cdk-lib</artifactId>
              <version>${cdk.version}</version>
        </dependency>
        <dependency>
          <groupId>io.github.hsiehshujeng</groupId>
          <artifactId>cdk-databrew-cicd</artifactId>
          <version>${constrcut.verion}</version>
          </dependency>
       .
       .
       .
   </dependencies>
  ```

  ```java
  package com.myorg;

  import software.amazon.awscdk.core.CfnOutput;
  import software.amazon.awscdk.core.CfnOutputProps;
  import software.amazon.awscdk.core.Construct;
  import software.amazon.awscdk.core.Stack;
  import software.amazon.awscdk.core.StackProps;
  import io.github.hsiehshujeng.cdk.databrew.cicd.DataBrewCodePipeline;
  import io.github.hsiehshujeng.cdk.databrew.cicd.DataBrewCodePipelineProps;

  public class JavaStack extends Stack {
      public JavaStack(final Construct scope, final String id) {
          this(scope, id, null);
      }

      public JavaStack(final Construct scope, final String id, final StackProps props) {
          super(scope, id, props);
          String preproductionAccountId = "PREPRODUCTION_ACCOUNT_ID";
          String productionAccountId = "PRODUCTION_ACCOUNT_ID";
          DataBrewCodePipeline databrewPipeline = new DataBrewCodePipeline(this, "DataBrewCicdPipeline",
                  DataBrewCodePipelineProps.builder().preproductionIamRoleArn(preproductionAccountId)
                          .productionIamRoleArn(productionAccountId)
                          // .bucketName("OPTIONAL")
                          // .branchName("OPTIONAL")
                          // .pipelineName("OPTIONAL")
                          .build());

          new CfnOutput(this, "OPreproductionLambdaArn",
                  CfnOutputProps.builder()
                      .value(databrewPipeline.getPreproductionFunctionArn())
                      .build());
          new CfnOutput(this, "OProductionLambdaArn",
                  CfnOutputProps.builder()
                      .value(databrewPipeline.getProductionFunctionArn())
                      .build());
          new CfnOutput(this, "OCodeCommitRepoArn",
                  CfnOutputProps.builder()
                      .value(databrewPipeline.getCodeCommitRepoArn())
                      .build());
          new CfnOutput(this, "OCodePipelineArn",
                  CfnOutputProps.builder()
                      .value(databrewPipeline.getCodePipelineArn())
                      .build());
      }
  }
  ```



  You could also refer to [here](https://github.com/HsiehShuJeng/cdk-databrew-cicd/tree/main/src/demo/csharp).

  ```bash
  $ cdk init --language csharp
  $ dotnet add src/Csharp package Databrew.Cicd --version 2.0.196
  ```

  ```cs
  using Amazon.CDK;
  using ScottHsieh.Cdk;

  namespace Csharp
  {
      public class CsharpStack : Stack
      {
          internal CsharpStack(Construct scope, string id, IStackProps props = null) : base(scope, id, props)
          {
              var preproductionAccountId = "PREPRODUCTION_ACCOUNT_ID";
              var productionAccountId = "PRODUCTION_ACCOUNT_ID";

              var dataBrewPipeline = new DataBrewCodePipeline(this, "DataBrewCicdPipeline", new DataBrewCodePipelineProps
              {
                  PreproductionIamRoleArn = $"arn:{Aws.PARTITION}:iam::{preproductionAccountId}:role/preproduction-Databrew-Cicd-Role",
                  ProductionIamRoleArn = $"arn:{Aws.PARTITION}:iam::{productionAccountId}:role/preproduction-Databrew-Cicd-Role",
                  // BucketName = "OPTIONAL",
                  // RepoName = "OPTIONAL",
                  // BranchName = "OPTIONAL",
                  // PipelineName = "OPTIONAL"
              });
              new CfnOutput(this, "OPreproductionLambdaArn", new CfnOutputProps
              {
                  Value = dataBrewPipeline.PreproductionFunctionArn
              });
              new CfnOutput(this, "OProductionLambdaArn", new CfnOutputProps
              {
                  Value = dataBrewPipeline.ProductionFunctionArn
              });
              new CfnOutput(this, "OCodeCommitRepoArn", new CfnOutputProps
              {
                  Value = dataBrewPipeline.CodeCommitRepoArn
              });
              new CfnOutput(this, "OCodePipelineArn", new CfnOutputProps
              {
                  Value = dataBrewPipeline.CodeCommitRepoArn
              });
          }
      }
  }
  ```



  You could also refer to [here](src/demo/go_lang/).

  ```bash

  cdk init app -l go

  go get github.com/HsiehShuJeng/cdk-databrew-cicd-go/cdkdatabrewcicd/v2@v2.0.196

  go mod tidy

  go get -u ./...
  ```

  ```go
  package main

  import (
  	"fmt"

  	"github.com/aws/aws-cdk-go/awscdk/v2"

  	// "github.com/aws/aws-cdk-go/awscdk/v2/awssqs"
  	"github.com/HsiehShuJeng/cdk-databrew-cicd-go/cdkdatabrewcicd/v2"
  	"github.com/aws/constructs-go/constructs/v10"
  	"github.com/aws/jsii-runtime-go"
  )

  type GoLangStackProps struct {
  	awscdk.StackProps
  }

  func NewGoLangStack(scope constructs.Construct, id string, props *GoLangStackProps) awscdk.Stack {
  	var sprops awscdk.StackProps
  	if props != nil {
  		sprops = props.StackProps
  	}
  	stack := awscdk.NewStack(scope, &id, &sprops)

  	preproductionAccountId := "PREPRODUCTION_ACCOUNT_ID"
  	productionAccountId := "PRODUCTION_ACCOUNT_ID"

  	dataBrewPipeline := cdkdatabrewcicd.NewDataBrewCodePipeline(stack, jsii.String("DataBrewCicdPipeline"), &cdkdatabrewcicd.DataBrewCodePipelineProps{
  		PreproductionIamRoleArn: jsii.String(fmt.Sprintf("arn:%s:iam::%s:role/preproduction-Databrew-Cicd-Role", *awscdk.Aws_PARTITION(), preproductionAccountId)),
  		ProductionIamRoleArn:    jsii.String(fmt.Sprintf("arn:%s:iam::%s:role/production-Databrew-Cicd-Role", *awscdk.Aws_PARTITION(), productionAccountId)),
  		// BucketName:   jsii.String("OPTIONAL"),
  		// RepoName:     jsii.String("OPTIONAL"),
  		// BranchName:   jsii.String("OPTIONAL"),
  		// PipelineName: jsii.String("OPTIONAL"),
  	})

  	awscdk.NewCfnOutput(stack, jsii.String("OPreproductionLambdaArn"), &awscdk.CfnOutputProps{Value: dataBrewPipeline.PreproductionFunctionArn()})
  	awscdk.NewCfnOutput(stack, jsii.String("OProductionLambdaArn"), &awscdk.CfnOutputProps{Value: dataBrewPipeline.ProductionFunctionArn()})
  	awscdk.NewCfnOutput(stack, jsii.String("OCodeCommitRepoArn"), &awscdk.CfnOutputProps{Value: dataBrewPipeline.CodeCommitRepoArn()})
  	awscdk.NewCfnOutput(stack, jsii.String("OCodePipelineArn"), &awscdk.CfnOutputProps{Value: dataBrewPipeline.CodePipelineArn()})

  	return stack
  }

  func main() {
  	defer jsii.Close()

  	app := awscdk.NewApp(nil)

  	NewGoLangStack(app, "GoLangStack", &GoLangStackProps{
  		awscdk.StackProps{
  			Env: env(),
  		},
  	})

  	app.Synth(nil)
  }

  func env() *awscdk.Environment {
  	return nil
  }

  ```





  1. Create HTTPS Git credentials for AWS CodeCommit with an IAM user that you're going to use.
     ![image](https://raw.githubusercontent.com/HsiehShuJeng/cdk-databrew-cicd/main/images/codecommit_credentials.png)
  2. Run through the steps noted on the README.md of the CodeCommit repository after finishing establishing the stack via CDK. The returned message with success should be looked like the following (assume you have installed [`git-remote-codecommit`](https://pypi.org/project/git-remote-codecommit/)):

     ```bash
     $ git clone codecommit://scott.codecommit@DataBrew-Recipes-Repo
     Cloning into 'DataBrew-Recipes-Repo'...
     remote: Counting objects: 6, done.
     Unpacking objects: 100% (6/6), 2.03 KiB | 138.00 KiB/s, done.
     ```
  3. Add a DataBrew recipe into the local repositroy (directory) and commit the change. (either directly on the main branch or merging another branch into the main branch)



  1. Download any recipe either generated out by following [*Getting started with AWS Glue DataBrew*](https://docs.aws.amazon.com/zh_tw/databrew/latest/dg/getting-started.html) or made by yourself as **JSON file**.
     ![image](https://raw.githubusercontent.com/HsiehShuJeng/cdk-databrew-cicd/main/images/databrew_recipes.png)
  2. Move the recipe from the download directory to the local directory for the CodeCommit repository.

     ```bash
     $ mv ${DOWNLOAD_DIRECTORY}/chess-project-recipe.json ${CODECOMMIT_LOCAL_DIRECTORY}/
     ```
  3. Commit the change to a branch with a name you prefer.

     ```bash
     $ cd ${{CODECOMMIT_LOCAL_DIRECTORY}}
     $ git checkout -b add-recipe main
     $ git add .
     $ git commit -m "first recipe"
     $ git push --set-upstream origin add-recipe
     ```
  4. Merge the branch into the main branch. Just go to the **AWS CodeCommit** web console to do the merge as its process is purely the same as you've already done thousands of times on **Github** but only with different UIs.



  1. In the infrastructure account, the status of the CodePipeline DataBrew pipeline should be similar as the following:
     ![image](https://raw.githubusercontent.com/HsiehShuJeng/cdk-databrew-cicd/main/images/infra_codepipeline.png)
  2. In the **pre-production** account with the same region as where the CICD pipeline is deployed at the infrastructue account, you'll see this.
     ![image](https://raw.githubusercontent.com/HsiehShuJeng/cdk-databrew-cicd/main/images/preproduction-recipe.png)
  3. In the **production** account with the same region as where the CICD pipeline is deployed at the infrastructue account, you'll see this.
     ![image](https://raw.githubusercontent.com/HsiehShuJeng/cdk-databrew-cicd/main/images/production-recipe.png)


pkgId: ff81a22bb9bdd1140d1e74a860423a7798bec271236edb247099b9f3aa463f74
name: python-cdk-docker-image-deployment
arch: src
version: 0.0.632
epoch: 0
release: 1
url: https://github.com/cdklabs/cdk-docker-image-deployment#readme
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-docker-image-deployment-0.0.632-1.src.rpm
checksum_type: sha256
summary:
  This module allows you to copy docker image assets to a repository you control. This can be necessary if you want to build a Docker image in one CDK app and consume it in a different app or outside the CDK.

description:
  This module allows you to copy docker image assets to a repository you control.
  This can be necessary if you want to build a Docker image in one CDK app and consume it in a different app or outside the CDK,
  or if you want to apply a lifecycle policy to all images of a part of your application.



  Below is a basic example for how to use the `DockerImageDeployment` API:

  ```python
  import * as ecr from 'aws-cdk-lib/aws-ecr';
  import * as imagedeploy from 'cdk-docker-image-deployment';

  const repo = ecr.Repository.fromRepositoryName(this, 'MyRepository', 'myrepository');

  new imagedeploy.DockerImageDeployment(this, 'ExampleImageDeploymentWithTag', {
    source: imagedeploy.Source.directory('path/to/directory'),
    destination: imagedeploy.Destination.ecr(repo, {
      tag: 'myspecialtag',
    }),
  });
  ```



  * `Source.directory()`: Supply a path to a local docker image as source.

  > Don't see a source listed? See if there is an open [issue](https://github.com/cdklabs/cdk-docker-image-deployment/issues)
  > or [PR](https://github.com/cdklabs/cdk-docker-image-deployment/pulls) already. If not, please open an issue asking for it
  > or better yet, submit a contribution!



  * `Destination.ecr(repo, options)`: Send your docker image to an ECR repository in your stack's account.

  > Don't see a destination listed? See if there is an open [issue](https://github.com/cdklabs/cdk-docker-image-deployment/issues)
  > or [PR](https://github.com/cdklabs/cdk-docker-image-deployment/pulls) already. If not, please open an issue asking for it
  > or better yet, submit a contribution!



  1. When this stack is deployed (either via cdk deploy or via CI/CD), the contents of the local Docker image will be archived and uploaded to an intermediary assets ECR Repository using the cdk-assets mechanism.
  2. The `DockerImageDeployment` construct synthesizes a CodeBuild Project which uses docker to pull the image from the intermediary repository, tag the image if a tag is provided, and push the image to the destination repository.
  3. The deployment will wait until the CodeBuild Project completes successfully before finishing.

  The architecture of this construct can be seen here:

  ![Construct-Architecture](https://user-images.githubusercontent.com/36202692/187282269-7ab29d3e-192f-470f-9123-5dbb62d9dac3.jpg)



  See [CONTRIBUTING](CONTRIBUTING.md#security-issue-notifications) for more information.



  This project is licensed under the Apache-2.0 License.


pkgId: c19daf5eb5c3b8f6232270af0f60a8d2ee516cde1ae8b9b31b6960b418c14155
name: python-cdk-dynamo-table-view
arch: src
version: 0.2.488
epoch: 0
release: 1
summary: An AWS CDK construct which exposes an endpoint with the contents of a DynamoDB table
url: https://github.com/cdklabs/cdk-dynamo-table-viewer.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-dynamo-table-view-0.2.488-1.src.rpm
checksum_type: sha256
description:
  An AWS CDK construct which exposes a public HTTP endpoint which displays an HTML
  page with the contents of a DynamoDB table in your stack.

  **SECURITY NOTE**: this construct was built for demonstration purposes and
  using it in production is probably a really bad idea. It exposes the entire
  contents of a DynamoDB table in your account to the general public.

  The library is published under the following names:

  |Language|Repository
  |--------|-----------
  |JavaScript/TypeScript|[cdk-dynamo-table-viewer](https://www.npmjs.com/package/cdk-dynamo-table-viewer)
  |Python|[cdk-dynamo-table-viewer](https://pypi.org/project/cdk-dynamo-table-viewer/)
  |.NET|[Eladb.DynamoTableViewer](https://www.nuget.org/packages/Eladb.DynamoTableViewer/)
  |Java|[com.github.eladb/cdk-dynamo-table-viewer](https://search.maven.org/artifact/com.github.eladb/cdk-dynamo-table-viewer)
  |Go|[github.com/cdklabs/cdk-dynamo-table-viewer-go/dynamotableviewer](https://pkg.go.dev/github.com/cdklabs/cdk-dynamo-table-viewer-go/dynamotableviewer)



  Install via npm:

  ```shell
  $ npm i cdk-dynamo-table-viewer
  ```

  Add to your CDK stack:

  ```python



  viewer = TableViewer(self, "CookiesViewer",
      table=cookies_table,
      title="Cookie Sales",  # optional
      sort_by="-sales"
  )
  ```

  Notes:

  * The endpoint will be available (as an deploy-time value) under `viewer.endpoint`.
    It will also be exported as a stack output.
  * Paging is not supported. This means that only the first 1MB of items will be
    displayed (again, this is a demo...)
  * Supports CDK version 2.60.0 and above



  Apache 2.0


pkgId: 1f441edbb09a58d0a0854c420b97a07b0421c232502baa7c55dfd0028d2ea742
name: python-cdk-ec2-key-pair
arch: src
version: 4.0.1
epoch: 0
release: 1
summary: CDK Construct for managing EC2 key pairs
url: https://github.com/udondan/cdk-ec2-key-pair
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-ec2-key-pair-4.0.1-1.src.rpm
checksum_type: sha256
description:
  [![Source](https://img.shields.io/badge/Source-GitHub-blue?logo=github)](https://github.com/udondan/cdk-ec2-key-pair)
  [![Test](https://github.com/udondan/cdk-ec2-key-pair/workflows/Test/badge.svg)](https://github.com/udondan/cdk-ec2-key-pair/actions?query=workflow%3ATest)
  [![GitHub](https://img.shields.io/github/license/udondan/cdk-ec2-key-pair)](https://github.com/udondan/cdk-ec2-key-pair/blob/main/LICENSE)
  [![Docs](https://img.shields.io/badge/Construct%20Hub-cdk--ec2--key--pair-orange)](https://constructs.dev/packages/cdk-ec2-key-pair)

  [![npm package](https://img.shields.io/npm/v/cdk-ec2-key-pair?color=brightgreen)](https://www.npmjs.com/package/cdk-ec2-key-pair)
  [![PyPI package](https://img.shields.io/pypi/v/cdk-ec2-key-pair?color=brightgreen)](https://pypi.org/project/cdk-ec2-key-pair/)

  ![Downloads](https://img.shields.io/badge/-DOWNLOADS:-brightgreen?color=gray)
  [![npm](https://img.shields.io/npm/dt/cdk-ec2-key-pair?label=npm&color=blueviolet)](https://www.npmjs.com/package/cdk-ec2-key-pair)
  [![PyPI](https://img.shields.io/pypi/dm/cdk-ec2-key-pair?label=pypi&color=blueviolet)](https://pypi.org/project/cdk-ec2-key-pair/)

  [AWS CDK](https://aws.amazon.com/cdk/) L3 construct for managing [EC2 Key Pairs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html).

  Manages RSA and ED25519 Key Pairs in EC2 through a Lambda function.

  Support for public key format in:

  * OpenSSH
  * ssh
  * PEM
  * PKCS#1
  * PKCS#8
  * RFC4253 (Base64 encoded)
  * PuTTY ppk

  > [!NOTE]
  > Please be aware, CloudFormation now natively supports creating EC2 Key Pairs via [AWS::EC2::KeyPair](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-keypair.html), so you can generally use [CDK's own KeyPair construct](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.KeyPair.html). There are a few differences, though, and this is why the custom construct remains valuable:
  >
  > * Instead of SSM Parameter Store, keys are stored in [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/)
  > * Secrets can be **KMS encrypted** - even different KMS keys for the private and public keys. Of course, SSM parameters *can* be encrypted too, CloudFormation just doesn't do it
  > * Optionally, this construct can store and expose the public key, enabling the user to directly use it as input for other resources, e.g. for CloudFront signed urls



  This package has peer dependencies, which need to be installed along in the expected version.

  For TypeScript/NodeJS, add these to your `dependencies` in `package.json`. For Python, add these to your `requirements.txt`:

  * cdk-ec2-key-pair
  * aws-cdk-lib (^2.116.0)
  * constructs (^10.0.0)



  ```python
  import cdk = require('aws-cdk-lib');
  import { Construct } from 'constructs';
  import { KeyPair } from 'cdk-ec2-key-pair';

  // ...

  // Create the Key Pair
  const key = new KeyPair(this, 'A-Key-Pair', {
    keyPairName: 'a-key-pair',
    description: 'This is a Key Pair',
    storePublicKey: true, // by default the public key will not be stored in Secrets Manager
  });

  // Grant read access to the private key to a role or user
  key.grantReadOnPrivateKey(someRole);

  // Grant read access to the public key to another role or user
  key.grantReadOnPublicKey(anotherRole);

  // Use Key Pair on an EC2 instance
  new ec2.Instance(this, 'An-Instance', {
    keyPair: key,
    // ...
  });
  ```

  The private (and optionally the public) key will be stored in AWS Secrets Manager. The secret names by default are prefixed with `ec2-ssh-key/`. The private key is suffixed with `/private`, the public key is suffixed with `/public`. So in this example they will be stored as `ec2-ssh-key/a-key-pair/private` and `ec2-ssh-key/a-key-pair/public`.

  To download the private key via AWS cli you can run:

  ```bash
  aws secretsmanager get-secret-value \
    --secret-id ec2-ssh-key/a-key-pair/private \
    --query SecretString \
    --output text
  ```



  The construct supports tagging:

  ```python
  cdk.Tags.of(key).add('someTag', 'some value');
  ```

  We also use tags to restrict update/delete actions to those, the construct created itself. The Lambda function, which backs the custom CFN resource, is not able to manipulate other keys/secrets. The tag we use for identifying these resources is `CreatedByCfnCustomResource` with value `CFN::Resource::Custom::EC2-Key-Pair`.



  Since an EC2 KeyPair cannot be updated, you cannot change any property related to the KeyPair. The code has checks in place which will prevent any attempt to do so. If you try, the stack will end in a failed state. In that case you can safely continue the rollback in the AWS console and ignore the key resource.

  You can, however, change properties that only relate to the secrets. These are the KMS keys used for encryption, the `secretPrefix`, `description` and `removeKeySecretsAfterDays`.



  Secrets in the AWS Secrets Manager by default are encrypted with the key `alias/aws/secretsmanager`.

  To use a custom KMS key you can pass it to the Key Pair:

  ```python
  const kmsKey = new kms.Key(this, 'KMS-key');

  const keyPair = new KeyPair(this, 'A-Key-Pair', {
    keyPairName: 'a-key-pair',
    kms: kmsKey,
  });
  ```

  This KMS key needs to be created in the same stack. You cannot use a key imported via ARN, because the keys access policy will need to be modified.

  To use different KMS keys for the private and public key, use the `kmsPrivateKey` and `kmsPublicKey` instead:

  ```python
  const kmsKeyPrivate = new kms.Key(this, 'KMS-key-private');
  const kmsKeyPublic = new kms.Key(this, 'KMS-key-public');

  const keyPair = new KeyPair(this, 'A-Key-Pair', {
    keyPairName: 'a-key-pair',
    kmsPrivateKey: kmsKeyPrivate,
    kmsPublicKey: kmsKeyPublic,
  });
  ```



  You can create a key pair by importing the public key. Obviously, in this case the private key won't be available in secrets manager.

  The public key has to be in OpenSSH format.

  ```python
  new KeyPair(this, 'Test-Key-Pair', {
    keyPairName: 'imported-key-pair',
    publicKey: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuMmbK...',
  });
  ```



  You can use this library for generating keys for CloudFront signed url/cookies.

  Make sure to set `publicKeyFormat` to `PublicKeyFormat.PEM` as that is the format required for CloudFront.
  You also have to set `exposePublicKey` to `true` so you can actually get the public key.

  ```python
  const key = new KeyPair(this, 'Signing-Key-Pair', {
    keyPairName: 'CFN-signing-key',
    exposePublicKey: true,
    storePublicKey: true,
    publicKeyFormat: PublicKeyFormat.PEM,
  });

  const pubKey = new cloudfront.PublicKey(this, 'Signing-Public-Key', {
    encodedKey: key.publicKeyValue,
  });
  const trustedKeyGroupForCF = new cloudfront.KeyGroup(
    this,
    'Signing-Key-Group',
    {
      items: [pubKey],
    },
  );
  ```


pkgId: 370fab3eb5a7c26d724c78cfaf150dc088ba69c4d875dec9ca9728b440377ff1
name: python-cdk-ec2spot
arch: src
version: 2.0.292
epoch: 0
release: 1
summary: CDK construct library for EC2 Spot
url: https://github.com/pahud/cdk-ec2spot.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-ec2spot-2.0.292-1.src.rpm
checksum_type: sha256
description:
  [![NPM version](https://badge.fury.io/js/cdk-ec2spot.svg)](https://badge.fury.io/js/cdk-ec2spot)
  [![PyPI version](https://badge.fury.io/py/cdk-ec2spot.svg)](https://badge.fury.io/py/cdk-ec2spot)
  ![Release](https://github.com/pahud/cdk-ec2spot/workflows/Release/badge.svg)



  CDK construct library that allows you to create EC2 Spot instances with `AWS AutoScaling Group`, `Spot Fleet` or just single `Spot Instance`.



  Use the npm dist tag to opt in CDKv1 or CDKv2:

  ```sh
  // for CDKv2
  npm install cdk-ec2spot
  or
  npm install cdk-ec2spot@latest

  // for CDKv1
  npm install cdk-ec2spot@cdkv1
  ```



  ```python
  import * as ec2spot from 'cdk-ec2spot';

  // create a ec2spot provider
  const provider = new ec2spot.Provider(stack, 'Provider');

  // import or create a vpc
  const vpc = provider.getOrCreateVpc(stack);

  // create an AutoScalingGroup with Launch Template for spot instances
  provider.createAutoScalingGroup('SpotASG', {
    vpc,
    defaultCapacitySize: 2,
    instanceType: new ec2.InstanceType('m5.large'),
  });
  ```



  In addition to EC2 AutoScaling Group, you may use `createFleet()` to create an EC2 Spot Fleet:

  ```python
  provider.createFleet('SpotFleet', {
    vpc,
    defaultCapacitySize: 2,
    instanceType: new ec2.InstanceType('t3.large'),
  });
  ```



  If you just need single spot instance without any autoscaling group or spot fleet, use `createInstance()`:

  ```python
  provider.createInstance('SpotInstance', { vpc })
  ```


pkgId: 5bd7b28948ea3ba9db166432c2b089f5004b704f951036004c81bf4eea251a1b
name: python-cdk-ecr-deployment
arch: src
version: 3.0.118
epoch: 0
release: 1
summary: CDK construct to deploy docker image to Amazon ECR
url: https://github.com/cdklabs/cdk-ecr-deployment
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-ecr-deployment-3.0.118-1.src.rpm
checksum_type: sha256
description:
  [![Release](https://github.com/cdklabs/cdk-ecr-deployment/actions/workflows/release.yml/badge.svg)](https://github.com/cdklabs/cdk-ecr-deployment/actions/workflows/release.yml)
  [![npm version](https://img.shields.io/npm/v/cdk-ecr-deployment)](https://www.npmjs.com/package/cdk-ecr-deployment)
  [![PyPI](https://img.shields.io/pypi/v/cdk-ecr-deployment)](https://pypi.org/project/cdk-ecr-deployment)
  [![npm](https://img.shields.io/npm/dw/cdk-ecr-deployment?label=npm%20downloads)](https://www.npmjs.com/package/cdk-ecr-deployment)
  [![PyPI - Downloads](https://img.shields.io/pypi/dw/cdk-ecr-deployment?label=pypi%20downloads)](https://pypi.org/project/cdk-ecr-deployment)

  CDK construct to synchronize single docker image between docker registries.

  **Only use v3 of this package**

  ⚠️ Version 2.* is no longer supported, as the Go.1.x runtime is no longer supported in AWS Lambda.\
  ⚠️ Version 1.* is no longer supported, as CDK v1 has reached the end-of-life
  stage.



  * Copy image from ECR/external registry to (another) ECR/external registry
  * Copy an archive tarball image from s3 to ECR/external registry



  Enable flags: `true`, `1`. e.g. `export CI=1`

  * `CI` indicate if it's CI environment. This flag will enable building lambda from scratch.
  * `NO_PREBUILT_LAMBDA` disable using prebuilt lambda.
  * `FORCE_PREBUILT_LAMBDA` force using prebuilt lambda.

  ⚠️ If you want to force using prebuilt lambda in CI environment to reduce build time. Try `export FORCE_PREBUILT_LAMBDA=1`.



  ```python
  from aws_cdk.aws_ecr_assets import DockerImageAsset


  image = DockerImageAsset(self, "CDKDockerImage",
      directory=path.join(__dirname, "docker")
  )


  ecrdeploy.ECRDeployment(self, "DeployDockerImage1",
      src=ecrdeploy.DockerImageName(image.image_uri),
      dest=ecrdeploy.DockerImageName(f"{cdk.Aws.ACCOUNT_ID}.dkr.ecr.us-west-2.amazonaws.com/my-nginx:latest")
  )


  ecrdeploy.ECRDeployment(self, "DeployDockerImage2",
      src=ecrdeploy.DockerImageName("nginx:latest"),
      dest=ecrdeploy.DockerImageName(f"{cdk.Aws.ACCOUNT_ID}.dkr.ecr.us-west-2.amazonaws.com/my-nginx2:latest")
  )



  ecrdeploy.ECRDeployment(self, "DeployDockerImage3",
      src=ecrdeploy.DockerImageName("javacs3/nginx:latest", "username:password"),
      
      
      dest=ecrdeploy.DockerImageName(f"{cdk.Aws.ACCOUNT_ID}.dkr.ecr.us-west-2.amazonaws.com/my-nginx3:latest")
  ).add_to_principal_policy(iam.PolicyStatement(
      effect=iam.Effect.ALLOW,
      actions=["secretsmanager:GetSecretValue"
      ],
      resources=["*"]
  ))
  ```



  ```shell

  NO_PREBUILT_LAMBDA=1 npx cdk deploy -a "npx ts-node -P tsconfig.dev.json --prefer-ts-exts test/example.ecr-deployment.ts"
  ```





  The core of this project relies on [containers/image](https://github.com/containers/image) which is used by [Skopeo](https://github.com/containers/skopeo).
  Please take a look at those projects before contribution.

  To support a new docker image source(like docker tarball in s3), you need to implement [image transport interface](https://github.com/containers/image/blob/master/types/types.go). You could take a look at [docker-archive](https://github.com/containers/image/blob/ccb87a8d0f45cf28846e307eb0ec2b9d38a458c2/docker/archive/transport.go) transport for a good start.

  To test the `lambda` folder, `make test`.


pkgId: 48d5e3ae49392283fd87bd64f097cbce0978b23518a4e3c927261ce256f3bf5d
name: python-cdk-ecr-image-scan-notify
arch: src
version: 1.0.242
epoch: 0
release: 1
url: https://github.com/hayao-k/cdk-ecr-image-scan-notify.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-ecr-image-scan-notify-1.0.242-1.src.rpm
checksum_type: sha256
summary:
  cdk-ecr-image-scan-notify is an AWS CDK construct library that notify the slack channel of Amazon ECR image scan results

description:
  [![NPM version](https://badge.fury.io/js/cdk-ecr-image-scan-notify.svg)](https://badge.fury.io/js/cdk-ecr-image-scan-notify)
  [![PyPI version](https://badge.fury.io/py/cdk-ecr-image-scan-notify.svg)](https://badge.fury.io/py/cdk-ecr-image-scan-notify)
  ![Release](https://github.com/hayao-k/cdk-ecr-image-scan-notify/workflows/release/badge.svg)



  cdk-ecr-image-scan-notify is an AWS CDK construct library that notify the slack channel of Amazon ECR image scan results.



  Amazon EventBridge (CloudWatch Events) detects the image scan execution and starts the Lambda function.
  The Lambda function summarizes the scan results, formatting them and notifying Slack.

  Basic scanning

  ![](https://raw.githubusercontent.com/hayao-k/cdk-ecr-image-scan-notify/main/images/basic-scanning.png)

  Enhanced scanning (Support for initial scan only)

  ![](https://raw.githubusercontent.com/hayao-k/cdk-ecr-image-scan-notify/main/images/enhanced-scanning.png)

  Click on an image name to go to the scan results page.

  ![](https://github.com/hayao-k/ecr-image-scan-findings-to-slack/raw/master/docs/images/scan-result.png)





  Installation

  ```
  $ yarn add cdk-ecr-image-scan-notify
  ```

  Usage

  ```python
  import * as cdk from 'aws-cdk-lib';
  import { EcrImageScanNotify } from 'cdk-ecr-image-scan-notify';

  const mockApp = new cdk.App();
  const stack = new cdk.Stack(mockApp, '<your-stack-name>');

  new EcrImageScanNotify(stack, 'ecr-image-scan-notify', {
    webhookUrl: '<your-incoming-webhook-url>',
  });
  ```

  Deploy!

  ```
  $ cdk deploy
  ```



  Installation

  ```
  $ pip install cdk-ecr-image-scan-notify
  ```

  Usage

  ```py
  import aws_cdk as cdk
  from cdk_ecr_image_scan_notify import EcrImageScanNotify

  app = cdk.App()
  stack = cdk.Stack(app, "<your-stack-name>", env={'region': 'ap-northeast-1'})

  EcrImageScanNotify(stack, "EcrImageScanNotify",
      webhook_url = '<your-incoming-webhook-url>',
  )
  ```

  Deploy!

  ```
  $ cdk deploy
  ```


pkgId: 587432c84f339a760160a607bde1e279fd2d3753c89e18bfcbc513ff77ab0b89
name: python-cdk-ecs-service-extensions
arch: src
version: 2.0.0
epoch: 0
release: 1
summary: @aws-cdk-containers/ecs-service-extensions
url: https://github.com/cdklabs/cdk-ecs-service-extensions.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-ecs-service-extensions-2.0.0-1.src.rpm
checksum_type: sha256
description:
  <!--END STABILITY BANNER-->
  This library provides a high level, extensible pattern for constructing services
  deployed using Amazon ECS.
  ```python
  import {
    AppMeshExtension,
    CloudwatchAgentExtension,
    Container,
    Environment,
    FireLensExtension,
    HttpLoadBalancerExtension,
    Service,
    ServiceDescription,
    XRayExtension,
  } from 'cdk-ecs-service-extensions';
  ```
  The `Service` construct provided by this module can be extended with optional `ServiceExtension` classes that add supplemental ECS features including:
  * [AWS X-Ray](https://aws.amazon.com/xray/) for tracing your application
  * [Amazon CloudWatch Agent](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Install-CloudWatch-Agent.html) for capturing per task stats
  * [AWS AppMesh](https://aws.amazon.com/app-mesh/) for adding your application to a service mesh
  * [Application Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html), for exposing your service to the public
  * [AWS FireLens](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_firelens.html), for filtering and routing application logs
  * [Injecter Extension](#injecter-extension), for allowing your service connect to other AWS services by granting permission and injecting environment variables
  * [Queue Extension](#queue-extension), for allowing your service to consume messages from an SQS Queue which can be populated by one or more SNS Topics that it is subscribed to
  * [Community Extensions](#community-extensions), providing support for advanced use cases
  The `ServiceExtension` class is an abstract class which you can also implement in
  order to build your own custom service extensions for modifying your service, or
  attaching your own custom resources or sidecars.

  ```python
  // Create an environment to deploy a service in.
  const environment = new Environment(this, 'production');
  // Build out the service description
  const nameDescription = new ServiceDescription();
  nameDescription.add(new Container({
    cpu: 1024,
    memoryMiB: 2048,
    trafficPort: 80,
    image: ecs.ContainerImage.fromRegistry('nathanpeck/name'),
    environment: {
      PORT: '80',
    },
  }));
  declare const mesh: appmesh.Mesh;
  nameDescription.add(new AppMeshExtension({ mesh }));
  nameDescription.add(new FireLensExtension());
  nameDescription.add(new XRayExtension());
  nameDescription.add(new CloudwatchAgentExtension());
  nameDescription.add(new HttpLoadBalancerExtension());
  // Implement the service description as a real service inside
  // an environment.
  const nameService = new Service(this, 'name', {
    environment: environment,
    serviceDescription: nameDescription,
  });
  ```

  An `Environment` is a place to deploy your services. You can have multiple environments
  on a single AWS account. For example, you could create a `test` environment as well
  as a `production` environment so you have a place to verify that your application
  works as intended before you deploy it to a live environment.
  Each environment is isolated from other environments. In other words,
  when you create an environment, by default the construct supplies its own VPC,
  ECS Cluster, and any other required resources for the environment:
  ```python
  const environment = new Environment(this, 'production');
  ```
  However, you can also choose to build an environment out of a pre-existing VPC
  or ECS Cluster:
  ```python
  declare const vpc: ec2.Vpc;
  const cluster = new ecs.Cluster(this, 'Cluster', { vpc });
  const environment = new Environment(this, 'production', {
    vpc,
    cluster,
  });
  ```

  The `ServiceDescription` defines what application you want the service to run and
  what optional extensions you want to add to the service. The most basic form of a `ServiceDescription` looks like this:
  ```python
  const nameDescription = new ServiceDescription();
  nameDescription.add(new Container({
    cpu: 1024,
    memoryMiB: 2048,
    trafficPort: 80,
    image: ecs.ContainerImage.fromRegistry('nathanpeck/name'),
    environment: {
      PORT: '80',
    },
  }));
  ```
  Every `ServiceDescription` requires at minimum that you add a `Container` extension
  which defines the main application (essential) container to run for the service.

  If no observability extensions have been configured for a service, the ECS Service Extensions configures an `awslogs` log driver for the application container of the service to send the container logs to CloudWatch Logs.
  You can either provide a log group to the `Container` extension or one will be created for you by the CDK.
  Following is an example of an application with an `awslogs` log driver configured for the application container:
  ```python
  import * as logs from 'aws-cdk-lib/aws-logs';
  const environment = new Environment(this, 'production');
  const nameDescription = new ServiceDescription();
  nameDescription.add(new Container({
    cpu: 1024,
    memoryMiB: 2048,
    trafficPort: 80,
    image: ContainerImage.fromRegistry('nathanpeck/name'),
    environment: {
      PORT: '80',
    },
    logGroup: new logs.LogGroup(this, 'MyLogGroup'),
  }));
  ```
  If a log group is not provided, no observability extensions have been created, and the `ECS_SERVICE_EXTENSIONS_ENABLE_DEFAULT_LOG_DRIVER` feature flag is enabled, then logging will be configured by default and a log group will be created for you.
  The `ECS_SERVICE_EXTENSIONS_ENABLE_DEFAULT_LOG_DRIVER` feature flag is enabled by default in any CDK apps that are created with CDK v1.140.0 or v2.8.0 and later.
  To enable default logging for previous versions, ensure that the `ECS_SERVICE_EXTENSIONS_ENABLE_DEFAULT_LOG_DRIVER` flag within the application stack context is set to true, like so:
  ```python
  import * as cxapi from '@aws-cdk/cx-api';
  this.node.setContext(cxapi.ECS_SERVICE_EXTENSIONS_ENABLE_DEFAULT_LOG_DRIVER, true);
  ```
  Alternatively, you can also set the feature flag in the `cdk.json` file. For more information, refer the [docs](https://docs.aws.amazon.com/cdk/v2/guide/featureflags.html).
  After adding the `Container` extension, you can optionally enable additional features for the service using the `ServiceDescription.add()` method:
  ```python
  declare const mesh: appmesh.Mesh;
  const nameDescription = new ServiceDescription();
  nameDescription.add(new AppMeshExtension({ mesh }));
  nameDescription.add(new FireLensExtension());
  nameDescription.add(new XRayExtension());
  nameDescription.add(new CloudwatchAgentExtension());
  nameDescription.add(new HttpLoadBalancerExtension());
  nameDescription.add(new AssignPublicIpExtension());
  ```

  Once the service description is defined, you can launch it as a service:
  ```python
  const environment = new Environment(this, 'production');
  const nameDescription = new ServiceDescription();
  const nameService = new Service(this, 'name', {
    environment: environment,
    serviceDescription: nameDescription,
  });
  ```
  At this point, all the service resources will be created. This includes the ECS Task
  Definition, Service, as well as any other attached resources, such as App Mesh Virtual
  Node or an Application Load Balancer.

  Sometimes the taskRole should be defined outside of the service so that you can create strict resource policies (ie. S3 bucket policies) that are restricted to a given taskRole:
  ```python
  const taskRole = new iam.Role(this, 'CustomTaskRole', {
    assumedBy: new iam.ServicePrincipal('ecs-tasks.amazonaws.com'),
  });
  // Use taskRole in any CDK resource policies
  // new s3.BucketPolicy(this, 'BucketPolicy, {});
  const environment = new Environment(this, 'production');
  const nameDescription = new ServiceDescription();
  const nameService = new Service(this, 'name', {
    environment: environment,
    serviceDescription: nameDescription,
    taskRole,
  });
  ```

  You can configure the task count of a service to match demand. The recommended way of achieving this is to configure target tracking policies for your service which scales in and out in order to keep metrics around target values.
  You need to configure an auto scaling target for the service by setting the `minTaskCount` (defaults to 1) and `maxTaskCount` in the `Service` construct. Then you can specify target values for "CPU Utilization" or "Memory Utilization" across all tasks in your service. Note that the `desiredCount` value will be set to `undefined` if the auto scaling target is configured.
  If you want to configure auto-scaling policies based on resources like Application Load Balancer or SQS Queues, you can set the corresponding resource-specific fields in the extension. For example, you can enable target tracking scaling based on Application Load Balancer request count as follows:
  ```python
  const environment = new Environment(this, 'production');
  const serviceDescription = new ServiceDescription();
  serviceDescription.add(new Container({
    cpu: 256,
    memoryMiB: 512,
    trafficPort: 80,
    image: ecs.ContainerImage.fromRegistry('my-alb'),
  }));
  // Add the extension with target `requestsPerTarget` value set
  serviceDescription.add(new HttpLoadBalancerExtension({ requestsPerTarget: 10 }));
  // Configure the auto scaling target
  new Service(this, 'my-service', {
    environment,
    serviceDescription,
    desiredCount: 5,
    // Task auto-scaling constuct for the service
    autoScaleTaskCount: {
      maxTaskCount: 10,
      targetCpuUtilization: 70,
      targetMemoryUtilization: 50,
    },
  });
  ```
  You can also define your own service extensions for [other auto-scaling policies](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-auto-scaling.html) for your service by making use of the `scalableTaskCount` attribute of the `Service` class.

  In addition to using the default service extensions that come with this module, you
  can choose to implement your own custom service extensions. The `ServiceExtension`
  class is an abstract class you can implement yourself. The following example
  implements a custom service extension that could be added to a service in order to
  autoscale it based on scaling intervals of SQS Queue size:
  ```python
  export class MyCustomAutoscaling extends ServiceExtension {
    constructor() {
      super('my-custom-autoscaling');
      // Scaling intervals for the step scaling policy
      this.scalingSteps = [{ upper: 0, change: -1 }, { lower: 100, change: +1 }, { lower: 500, change: +5 }];
      this.sqsQueue = new sqs.Queue(this.scope, 'my-queue');
    }
    // This hook utilizes the resulting service construct
    // once it is created
    public useService(service: ecs.Ec2Service | ecs.FargateService) {
      this.parentService.scalableTaskCount.scaleOnMetric('QueueMessagesVisibleScaling', {
        metric: this.sqsQueue.metricApproximateNumberOfMessagesVisible(),
        scalingSteps: this.scalingSteps,
      });
    }
  }
  ```
  This `ServiceExtension` can now be reused and added to any number of different
  service descriptions. This allows you to develop reusable bits of configuration,
  attach them to many different services, and centrally manage them. Updating the
  `ServiceExtension` in one place would update all services that use it, instead of
  requiring decentralized updates to many different services.
  Every `ServiceExtension` can implement the following hooks to modify the properties
  of constructs, or make use of the resulting constructs:
  * `addHooks()` - This hook is called after all the extensions are added to a
    ServiceDescription, but before any of the other extension hooks have been run.
    It gives each extension a chance to do some inspection of the overall ServiceDescription
    and see what other extensions have been added. Some extensions may want to register
    hooks on the other extensions to modify them. For example, the Firelens extension
    wants to be able to modify the settings of the application container to route logs
    through Firelens.
  * `modifyTaskDefinitionProps()` - This is hook is passed the proposed
    ecs.TaskDefinitionProps for a TaskDefinition that is about to be created.
    This allows the extension to make modifications to the task definition props
    before the TaskDefinition is created. For example, the App Mesh extension modifies
    the proxy settings for the task.
  * `useTaskDefinition()` - After the TaskDefinition is created, this hook is
    passed the actual TaskDefinition construct that was created. This allows the
    extension to add containers to the task, modify the task definition's IAM role,
    etc.
  * `resolveContainerDependencies()` - Once all extensions have added their containers,
    each extension is given a chance to modify its container's `dependsOn` settings.
    Extensions need to check and see what other extensions were enabled and decide
    whether their container needs to wait on another container to start first.
  * `modifyServiceProps()` - Before an Ec2Service or FargateService is created, this
    hook is passed a draft version of the service props to change. Each extension adds
    its own modifications to the service properties. For example, the App Mesh extension
    needs to modify the service settings to enable CloudMap service discovery.
  * `useService()` - After the service is created, this hook is given a chance to
    utilize that service. This is used by extensions like the load balancer or App Mesh
    extension, which create and link other AWS resources to the ECS extension.
  * `connectToService()` - This hook is called when a user wants to connect one service
    to another service. It allows an extension to implement logic about how to allow
    connections from one service to another. For example, the App Mesh extension implements
    this method in order to easily connect one service mesh service to another, which
    allows the service's Envoy proxy sidecars to route traffic to each other.

  One of the hooks that a `ServiceExtension` can implement is a hook for connection
  logic. This is utilized when connecting one service to another service, e.g.
  connecting a user facing web service with a backend API. Usage looks like this:
  ```python
  const frontendDescription = new ServiceDescription();
  const frontend = new Service(this, 'frontend', {
    environment,
    serviceDescription: frontendDescription,
  });
  const backendDescription = new ServiceDescription();
  const backend = new Service(this, 'backend', {
    environment,
    serviceDescription: backendDescription,
  });
  frontend.connectTo(backend);
  ```
  The address that a service will use to talk to another service depends on the
  type of ingress that has been created by the extension that did the connecting.
  For example, if an App Mesh extension has been used, then the service is accessible
  at a DNS address of `<service name>.<environment name>`. For example:
  ```python
  const environment = new Environment(this, 'production');
  // Define the frontend tier
  const frontendDescription = new ServiceDescription();
  frontendDescription.add(new Container({
    cpu: 1024,
    memoryMiB: 2048,
    trafficPort: 80,
    image: ecs.ContainerImage.fromRegistry('my-frontend-service'),
    environment: {
      BACKEND_URL: 'http://backend.production',
    },
  }));
  const frontend = new Service(this, 'frontend', {
    environment,
    serviceDescription: frontendDescription,
  });
  // Define the backend tier
  const backendDescription = new ServiceDescription();
  backendDescription.add(new Container({
    cpu: 1024,
    memoryMiB: 2048,
    trafficPort: 80,
    image: ecs.ContainerImage.fromRegistry('my-backend-service'),
    environment: {
      FRONTEND_URL: 'http://frontend.production',
    },
  }));
  const backend = new Service(this, 'backend', {
    environment,
    serviceDescription: backendDescription,
  });
  // Connect the two tiers to each other
  frontend.connectTo(backend);
  ```
  The above code uses the well-known service discovery name for each
  service, and passes it as an environment variable to the container so
  that the container knows what address to use when communicating to
  the other service.

  To create an environment with a pre-existing cluster, you must import the cluster first, then use `Environment.fromEnvironmentAttributes()`. When a cluster is imported into an environment, the cluster is treated as immutable. As a result, no extension may modify the cluster to change a setting.
  ```python
  declare const cluster: ecs.Cluster;
  const environment = Environment.fromEnvironmentAttributes(this, 'Environment', {
    capacityType: ecs.EnvironmentCapacityType.EC2, // or `FARGATE`
    cluster,
  });
  ```

  This service extension accepts a list of `Injectable` resources. It grants access to these resources and adds the necessary environment variables to the tasks that are part of the service.
  For example, an `InjectableTopic` is an SNS Topic that grants permission to the task role and adds the topic ARN as an environment variable to the task definition.

  You can use this extension to set up publishing permissions for SNS Topics.
  ```python
  const nameDescription = new ServiceDescription();
  nameDescription.add(new InjecterExtension({
    injectables: [new InjectableTopic({
      // SNS Topic the service will publish to
      topic: new sns.Topic(this, 'my-topic'),
    })],
  }));
  ```

  This service extension creates a default SQS Queue `eventsQueue` for the service (if not provided) and optionally also accepts list of `ISubscribable` objects that the `eventsQueue` can subscribe to. The service extension creates the subscriptions and sets up permissions for the service to consume messages from the SQS Queue.

  You can use this extension to set up SNS Topic subscriptions for the `eventsQueue`. To do this, create a new object of type `TopicSubscription` for every SNS Topic you want the `eventsQueue` to subscribe to and provide it as input to the service extension.
  ```python
  const nameDescription = new ServiceDescription();
  const myServiceDescription = nameDescription.add(new QueueExtension({
    // Provide list of topic subscriptions that you want the `eventsQueue` to subscribe to
    subscriptions: [new TopicSubscription({
      topic: new sns.Topic(this, 'my-topic'),
    }],
  }));
  // To access the `eventsQueue` for the service, use the `eventsQueue` getter for the extension
  const myQueueExtension = myServiceDescription.extensions.queue as QueueExtension;
  const myEventsQueue = myQueueExtension.eventsQueue;
  ```
  For setting up a topic-specific queue subscription, you can provide a custom queue in the `TopicSubscription` object along with the SNS Topic. The extension will set up a topic subscription for the provided queue instead of the default `eventsQueue` of the service.
  ```python
  declare const myEventsQueue: sqs.Queue;
  declare const myTopicQueue: sqs.Queue;
  const nameDescription = new ServiceDescription();
  nameDescription.add(new QueueExtension({
    eventsQueue: myEventsQueue,
    subscriptions: [new TopicSubscription({
      topic: new sns.Topic(this, 'my-topic'),
      // `myTopicQueue` will subscribe to the `my-topic` instead of `eventsQueue`
      topicSubscriptionQueue: {
        queue: myTopicQueue,
      },
    }],
  }));
  ```

  You can scale your service up or down to maintain an acceptable queue latency by tracking the backlog per task. It configures a target tracking scaling policy with target value (acceptable backlog per task) calculated by dividing the `acceptableLatency` by `messageProcessingTime`. For example, if the maximum acceptable latency for a message to be processed after its arrival in the SQS Queue is 10 mins and the average processing time for a task is 250 milliseconds per message, then `acceptableBacklogPerTask = 10 *  60 / 0.25 = 2400`. Therefore, each queue can hold up to 2400 messages before the service starts to scale up. For this, a target tracking policy will be attached to the scaling target for your service with target value `2400`. For more information, please refer: https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-using-sqs-queue.html .
  You can configure auto scaling based on SQS Queue for your service as follows:
  ```python
  declare const myEventsQueue: sqs.Queue;
  declare const myTopicQueue: sqs.Queue;
  const nameDescription = new ServiceDescription();
  nameDescription.add(new QueueExtension({
    eventsQueue: myEventsQueue,
    // Need to specify `scaleOnLatency` to configure auto scaling based on SQS Queue
    scaleOnLatency: {
      acceptableLatency: Duration.minutes(10),
      messageProcessingTime: Duration.millis(250),
    },
    subscriptions: [new TopicSubscription({
      topic: new sns.Topic(this, 'my-topic'),
      // `myTopicQueue` will subscribe to the `my-topic` instead of `eventsQueue`
      topicSubscriptionQueue: {
        queue: myTopicQueue,
        // Optionally provide `scaleOnLatency` for configuring separate autoscaling for `myTopicQueue`
        scaleOnLatency: {
          acceptableLatency: Duration.minutes(10),
          messageProcessingTime: Duration.millis(250),
        },
      },
    }],
  }));
  ```

  The [Publish/Subscribe Service Pattern](https://aws.amazon.com/pub-sub-messaging/) is used for implementing asynchronous communication between services. It involves 'publisher' services emitting events to SNS Topics, which are passed to subscribed SQS queues and then consumed by 'worker' services.
  The following example adds the `InjecterExtension` to a `Publisher` Service which can publish events to an SNS Topic and adds the `QueueExtension` to a `Worker` Service which can poll its `eventsQueue` to consume messages populated by the topic.
  ```python
  const environment = new Environment(this, 'production');
  const pubServiceDescription = new ServiceDescription();
  pubServiceDescription.add(new Container({
    cpu: 256,
    memoryMiB: 512,
    trafficPort: 80,
    image: ecs.ContainerImage.fromRegistry('sns-publish'),
  }));
  const myTopic = new sns.Topic(this, 'myTopic');
  // Add the `InjecterExtension` to the service description to allow publishing events to `myTopic`
  pubServiceDescription.add(new InjecterExtension({
    injectables: [new InjectableTopic({
      topic: myTopic,
    }],
  }));
  // Create the `Publisher` Service
  new Service(this, 'Publisher', {
    environment: environment,
    serviceDescription: pubServiceDescription,
  });
  const subServiceDescription = new ServiceDescription();
  subServiceDescription.add(new Container({
    cpu: 256,
    memoryMiB: 512,
    trafficPort: 80,
    image: ecs.ContainerImage.fromRegistry('sqs-reader'),
  }));
  // Add the `QueueExtension` to the service description to subscribe to `myTopic`
  subServiceDescription.add(new QueueExtension({
    subscriptions: [new TopicSubscription({
      topic: myTopic,
    }],
  }));
  // Create the `Worker` Service
  new Service(this, 'Worker', {
    environment: environment,
    serviceDescription: subServiceDescription,
  });
  ```

  We encourage the development of Community Service Extensions that support
  advanced features. Here are some useful extensions that we have reviewed:
  * [ListenerRulesExtension](https://www.npmjs.com/package/@wheatstalk/ecs-service-extension-listener-rules) for more precise control over Application Load Balancer rules
  > Please submit a pull request so that we can review your service extension and
  > list it here.


pkgId: d9100143b8f183a8190b8898c4ee37d86915bc404ad264b887b588638319630e
name: python-cdk-eks-cluster-module
arch: src
version: 0.0.30
epoch: 0
release: 1
summary: @smallcase/cdk-eks-cluster-module
url: https://github.com/smallcase/cdk-eks-cluster-module.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-eks-cluster-module-0.0.30-1.src.rpm
checksum_type: sha256
description:
  cdk-eks-cluster-module  is a [CDK]((github.com/aws-cdk/cdk)) that helps you configure complete EKS clusters that are fully bootstrapped with the operational software that is needed to deploy and operate workloads. You can describe the configuration for the desired state of your EKS cluster, such as the control plane, worker nodes, and Kubernetes add-ons, as code.



  * :white_check_mark: AWS EKS Cluster Addons
  * :white_check_mark: Support for Multiple NodeGroups with labels and taints
  * :white_check_mark: Support for Multiple fargate profiles with labels and namespace
  * :white_check_mark: AWS EKS Identity Provider Configuration
  * :white_check_mark: Support for custom AMI, custom launch template, and custom user data including custom user data template
  * :white_check_mark: commonComponents interface allow to install custom repo/local helm chart
  * :white_check_mark: Install aws-ebs-csi-driver,aws-efs-csi-driver,node-problem-detector helm charts to help manage storage, and nodes.



  The quick start shows you how to create an **AWS-EKS** using this module.



  * A working [`aws`](https://aws.amazon.com/cli/) CLI installation with access to an account and administrator privileges
  * You'll need a recent [NodeJS](https://nodejs.org) installation
  * [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) to interact with your fresh cluster

  To get going you'll need a CDK project. For details please refer to the [detailed guide for CDK](https://docs.aws.amazon.com/cdk/latest/guide/hello_world.html).

  Create an empty directory on your system.

  ```bash
  mkdir aws-quick-start-eks && cd aws-quick-start-eks
  ```

  Bootstrap your CDK project, we will use TypeScript, but you can switch to any other supported language.

  ```bash
  npx cdk init sample-eks  --language typescript
  npx cdk bootstrap
  ```

  Install using NPM:

  ```
  npm install @smallcase/cdk-eks-cluster-module
  ```

  Using yarn

  ```
  yarn add @smallcase/cdk-eks-cluster-module
  ```

  Using eks cluster can be deployed using the following sample code snippet:

  ```python
  import {
    EKSCluster,
    VpcCniAddonVersion,
  } from '@smallcase/cdk-eks-cluster-module';

  const key = new kms.Key(this, 'EKS-KMS', {
        enabled: true,
        alias: 'EKS-KMS',
      });
  key.addToResourcePolicy(new iam.PolicyStatement({
        sid: 'encrypt root volumes of nodeGroup using kms',
        actions: [
          'kms:Encrypt',
          'kms:Decrypt',
          'kms:ReEncrypt*',
          'kms:GenerateDataKey*',
          'kms:CreateGrant',
          'kms:DescribeKey',
        ],
        resources: ['*'],
        principals: [new iam.AnyPrincipal()],
        conditions: {
          StringEquals: {
            'kms:CallerAccount': '<YOUR-AWS-ID>',
            'kms:ViaService': 'ec2.<REGION>.amazonaws.com',
          },
        },
      }));

    const securityGroup = new ec2.SecurityGroup(
        this,
        'EKS-WORKER-SG',
        {
          vpc: vpc,
          description: 'Kubernetes Worker SecurityGroup',
        },
      );

    const testNodeTemplete = new ec2.LaunchTemplate(this, 'testNodeTemplete', {
        instanceType: new ec2.InstanceType('m5a.large'),
        blockDevices: [
          {
            deviceName: '/dev/xvda',
            volume: ec2.BlockDeviceVolume.ebs(40,
              {
                deleteOnTermination: true,
                encrypted: true,
                volumeType: ec2.EbsDeviceVolumeType.GP3,
                kmsKey: key,
              },
            ),
            mappingEnabled: true,
          },
        ],
      });
  let ekscluster = new EKSCluster(this, 'EKS-CLUSTER', {
        availabilityZones: Stack.of(this).availabilityZones,
        clusterVPC: vpc,
        kmsKey: key,
        region: Stack.of(this).region,
        workerSecurityGroup: securityGroup,
        addonProps: {
          vpnCniAddonVersion: VpcCniAddonVersion.V1_11_0,
        },
        clusterConfig: {
          clusterName: 'EKS-CLUSTER',
          clusterVersion: eks.KubernetesVersion.V1_22,
          // this will create cluster autoscaler service account with iam role
          addAutoscalerIam: true,
          albControllerVersion: eks.AlbControllerVersion.V2_2_4,
          defaultCapacity: 3,
          subnets: {
            privateSubnetGroupName: 'Private',
          },
          nodeGroups: [
            {
              name: 'test-node',
              instanceTypes: [],
              minSize: 3,
              maxSize: 6,
              launchTemplateSpec: {
                version: testNodeTemplete.versionNumber,
                id: testNodeTemplete.launchTemplateId!,
              },
              subnetGroupName: 'Private',
              labels: {
                role: 'test-eks-cluster',
              },
              taints: {
                role: 'test-eks-cluster',
              },
              tags: {
                'k8s.io/cluster-autoscaler/enabled': 'TRUE',
                'k8s.io/cluster-autoscaler/EKS-CLUSTER':
                  'owned',
              },
            },
          ]
          commonComponents: {
            'aws-efs-csi-driver': {
              iamPolicyPath: ['../../assets/policy/aws-efs-csi-driver-policy.json'],
              // above mention iam policy will be used for this service account
              serviceAccounts: ['efs-csi-controller-sa', 'efs-csi-node-sa'],
              helm: {
                chartName: 'aws-efs-csi-driver',
                chartVersion: '2.2.0',
                helmRepository: 'https://kubernetes-sigs.github.io/aws-efs-csi-driver/',
                namespace: 'kube-system',
              },
            },
          },
          teamMembers: [
            "your-aws-user",
          ],
          teamExistingRolePermission: { //optional
            '<YOUR_ROLE_ARN>': 'system:masters',
          },
        }
    })
  ```


pkgId: a224bccfd551491b65afe3d335cfeadf2036650a2a5708dbb2ab083ff9c5351c
name: python-cdk-eks-karpenter
arch: src
version: 1.0.6
epoch: 0
release: 1
summary: CDK construct library that allows you install Karpenter in an AWS EKS cluster
url: https://github.com/aws-samples/cdk-eks-karpenter.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-eks-karpenter-1.0.6-1.src.rpm
checksum_type: sha256
description:
  This construct configures the necessary dependencies and installs [Karpenter](https://karpenter.sh)
  on an EKS cluster managed by AWS CDK.





  If you have not used EC2 spot in your AWS account before, follow the instructions
  [here](https://karpenter.sh/v0.31/getting-started/getting-started-with-karpenter/#3-create-a-cluster) to create
  the service linked role in your account allowing Karpenter to provision EC2 Spot Capacity.



  In your CDK project, initialize a new Karpenter construct for your EKS cluster, like this:

  ```python
  const cluster = new Cluster(this, 'testCluster', {
    vpc: vpc,
    role: clusterRole,
    version: KubernetesVersion.V1_27,
    defaultCapacity: 1
  });

  const karpenter = new Karpenter(this, 'Karpenter', {
    cluster: cluster
  });
  ```

  This will install and configure Karpenter in your cluster. To have Karpenter do something useful, you
  also need to create an [EC2NodeClass](https://karpenter.sh/docs/concepts/nodeclasses/) and an
  [NodePool](https://karpenter.sh/docs/concepts/nodepools/), for a more complete example, see
  [test/integ.karpenter.ts](./test/integ.karpenter.ts).





  As of [aws/karpenter#1145](https://github.com/aws/karpenter/pull/1145) the Karpenter Helm chart is
  refactored to specify `clusterEndpoint` and `clusterName` on the root level of the chart values, previously
  these values was specified under the key `controller`.



  This construct adds a custom task to [projen](https://projen.io/), so you can test a full deployment
  of an EKS cluster with Karpenter installed as specified in `test/integ.karpenter.ts` by running the
  following:

  ```sh
  export CDK_DEFAULT_REGION=<aws region>
  export CDK_DEFAULT_ACCOUNT=<account id>
  npx projen test:deploy
  ```

  As the above will create a cluster without EC2 capacity, with CoreDNS and Karpenter running as Fargate
  pods, you can test out the functionality of Karpenter by deploying an inflation deployment, which will
  spin up a number of pods that will trigger Karpenter creation of worker nodes:

  ```sh
  kubectl apply -f test/inflater-deployment.yml
  ```

  You can clean things up by deleting the deployment and the CDK test stack:

  ```sh
  kubectl delete -f test/inflater-deployment.yml
  npx projen test:destroy
  ```





  1. Ensure you have the appropriate linked role available in your account, for more details,
     see [the karpenter documentation](https://karpenter.sh/v0.31/getting-started/getting-started-with-karpenter/#3-create-a-cluster)


pkgId: 8f884131fc506829504379e23a7d6b21315bc2d15a61f91f08a6261a6d199845
name: python-cdk-eksdistro
arch: src
version: 2.0.13
epoch: 0
release: 1
summary: AWS CDK construct library for Amazon EKS Distro
url: https://github.com/pahud/cdk-eksdistro.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-eksdistro-2.0.13-1.src.rpm
checksum_type: sha256
description:
  [![NPM version](https://badge.fury.io/js/cdk-eksdistro.svg)](https://badge.fury.io/js/cdk-eksdistro)
  [![PyPI version](https://badge.fury.io/py/cdk-eksdistro.svg)](https://badge.fury.io/py/cdk-eksdistro)
  ![Release](https://github.com/pahud/cdk-eksdistro/workflows/Release/badge.svg)



  CDK construct library that allows you to create [Amazon EKS Distro](https://distro.eks.amazonaws.com/) on Amaozn EC2 instance(s).



  Under the hood, `cdk-eksdistro` creates an Amazon Auto Scaling Group with single Amazon EC2 instance running Ubuntu Linux LTS `20.04` and installs the [eks snap](https://snapcraft.io/eks) from the `UserData`.



  Use the npm dist tag to opt in CDKv1 or CDKv2:

  ```sh
  // for CDKv2
  npm install cdk-eksdistro
  or
  npm install cdk-eksdistro@latest

  // for CDKv1
  npm install cdk-eksdistro@cdkv1
  ```



  ```python
  imoprt { Cluster } from 'cdk-eksdistro';

  const app = new cdk.App();

  const env = {
    region: process.env.CDK_DEFAULT_REGION,
    account: process.env.CDK_DEFAULT_ACCOUNT,
  };

  const stack = new cdk.Stack(app, 'eksdistro-stack', { env });

  new Cluster(stack, 'Cluster');
  ```



  To create Amazon EC2 Spot instance instead of on-demand, use the `spot` property:

  ```python
  new Cluster(stack, 'Cluster', { spot: true });
  ```



  By default, the `Cluster` construct creates a single-node EKS-D cluster on AWS EC2 with the latest Ubuntu Linux LTS AMI. To validate the cluster, open the EC2 console, select the instance and click the **Connect** button and select **session manager**.

  Run the following commands to execute `kubectl` in the cluster.

  ![](https://pbs.twimg.com/media/EsEgnhoVoAIHnkr?format=jpg&name=4096x4096)



  * https://aws.amazon.com/blogs/opensource/introducing-amazon-eks-distro/
  * https://ubuntu.com/blog/install-amazon-eks-distro-anywhere
  * https://microk8s.io/
  * https://snapcraft.io/microk8s


pkgId: e1e1fae5f94c5c183bfb1a636b05ec7aa702e2230fede4c2a1f23de56dfe4228
name: python-cdk-emrserverless-with-delta-lake
arch: src
version: 2.0.580
epoch: 0
release: 1
summary: A construct for the quick demo of EMR Serverless.
url: https://github.com/HsiehShuJeng/cdk-emrserverless-with-delta-lake.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-emrserverless-with-delta-lake-2.0.580-1.src.rpm
checksum_type: sha256
description:
  [![License](https://img.shields.io/badge/License-Apache%202.0-green)](https://opensource.org/licenses/Apache-2.0) [![Release](https://github.com/HsiehShuJeng/cdk-emrserverless-with-delta-lake/actions/workflows/release.yml/badge.svg)](https://github.com/HsiehShuJeng/cdk-emrserverless-with-delta-lake/actions/workflows/release.yml/badge.svg) [![npm downloads](https://img.shields.io/npm/dt/cdk-emrserverless-with-delta-lake?label=npm%20downloads&style=plastic)](https://img.shields.io/npm/dt/cdk-emrserverless-with-delta-lake?label=npm%20downloads&style=plastic) [![pypi downloads](https://img.shields.io/pypi/dw/cdk-emrserverless-with-delta-lake?label=pypi%20downloads&style=plastic)](https://img.shields.io/pypi/dw/cdk-emrserverless-with-delta-lake?label=pypi%20downloads&style=plastic) [![NuGet downlods](https://img.shields.io/nuget/dt/Emrserverless.With.Delta.Lake?label=NuGet%20downloads&style=plastic)](https://img.shields.io/nuget/dt/Emrserverless.With.Delta.Lake?label=NuGet%20downloads&style=plastic) [![repo languages](https://img.shields.io/github/languages/count/HsiehShuJeng/cdk-emrserverless-with-delta-lake?style=plastic)](https://img.shields.io/github/languages/count/HsiehShuJeng/cdk-emrserverless-with-delta-lake?style=plastic)

  | npm (JS/TS) | PyPI (Python) | Maven (Java) | Go | NuGet |
  | --- | --- | --- | --- | --- |
  | [Link](https://www.npmjs.com/package/cdk-emrserverless-with-delta-lake) | [Link](https://pypi.org/project/cdk-emrserverless-with-delta-lake/) | [Link](https://search.maven.org/artifact/io.github.hsiehshujeng/cdk-emrserverless-quickdemo-with-delta-lake) | [Link](https://github.com/HsiehShuJeng/cdk-emrserverless-with-delta-lake-go) | [Link](https://www.nuget.org/packages/Emrserverless.With.Delta.Lake/) |

  ![high level architecture](https://raw.githubusercontent.com/HsiehShuJeng/cdk-emrserverless-with-delta-lake/main/images/high%20level%20architecture.png)

  This constrcut builds an EMR studio, a cluster template for the EMR Studio, and an EMR Serverless application. 2 S3 buckets will be created, one is for the EMR Studio workspace and the other one is for EMR Serverless applications. Besides, the VPC and the subnets for the EMR Studio will be tagged `{"Key": "for-use-with-amazon-emr-managed-policies", "Value": "true"}` via a custom resource. This is necessary for the [service role](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio-service-role.html#emr-studio-service-role-instructions) of EMR Studio.
  This construct is for analysts, data engineers, and anyone who wants to know how to process **Delta Lake data** with EMR serverless.
  ![cfn designer](https://github.com/HsiehShuJeng/cdk-emrserverless-with-delta-lake/blob/main/images/cfn-designer.png?raw=true)
  They build the construct via [cdkv2](https://docs.aws.amazon.com/cdk/v2/guide/home.html) and build a serverless job within the EMR application generated by the construct via AWS CLI within few minutes. After the EMR serverless job is finished, they can then check the processed result done by the EMR serverless job on an EMR notebook through the cluster template.
  ![app history](https://github.com/HsiehShuJeng/cdk-emrserverless-with-delta-lake/blob/main/images/spark%20jobs.png?raw=true)



  * [Requirements](#requirements)
  * [Before deployment](#before-deployment)
  * [Minimal content for deployment](#minimal-content-for-deployment)
  * [After deployment](#after-deployment)
  * [Create an EMR Serverless application](#create-an-emr-serverless-app)
  * [Check the executing job](#check-the-executing-job)
  * [Check results from an EMR notebook via cluster template](#check-results-from-an-emr-notebook-via-cluster-template)
  * [Fun facts](#fun-facts)
  * [Future work](#future-work)



  1. Your current identity has the `AdministratorAccess` power.
  2. [An IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started_create-admin-group.html) named `Administrator` with the `AdministratorAccess` power.

     * This is related to the Portfolio of AWS Service Catalog created by the construct, which is required for [EMR cluster tempaltes](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio-cluster-templates.html).
     * You can choose whatsoever identity you wish to associate with the Product in the Porfolio for creating an EMR cluster via cluster tempalte. Check `serviceCatalogProps` in the `EmrServerless` construct for detail, otherwise, the IAM user mentioned above will be chosen to set up with the Product.



  You might want to execute the following command.

  ```sh
  PROFILE_NAME="scott.hsieh"

  cdk bootstrap aws://${AWS_ACCOUNT_ID}/${AWS_REGION} --profile ${PROFILE_NAME}
  ```



  ```python

  import * as cdk from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { EmrServerless } from 'cdk-emrserverless-with-delta-lake';

  class TypescriptStack extends cdk.Stack {
    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
      super(scope, id, props);
      new EmrServerless(this, 'EmrServerless');
    }
  }

  const app = new cdk.App();
  new TypescriptStack(app, 'TypescriptStack', {
    stackName: 'emr-studio',
    env: {
      region: process.env.CDK_DEFAULT_REGION,
      account: process.env.CDK_DEFAULT_ACCOUNT,
    },
  });
  ```



  Promise me, darling, make advantage on the CloudFormation outputs.  All you need is **copy-paste**, **copy-paste**, **copy-paste**, life should be always that easy.
  ![cfn outputs](https://raw.githubusercontent.com/HsiehShuJeng/cdk-emrserverless-with-delta-lake/main/images/cfn-outputs.png)

  1. **Define the following environment variables on your current session.**

     ```
     export PROFILE_NAME="${YOUR_PROFILE_NAME}"
     export JOB_ROLE_ARN="${copy-paste-thank-you}"
     export APPLICATION_ID="${copy-paste-thank-you}"
     export SERVERLESS_BUCKET_NAME="${copy-paste-thank-you}"
     export DELTA_LAKE_SCRIPT_NAME="delta-lake-demo"
     ```
  2. **Copy partial NYC-taxi data into the EMR Serverless bucket.**

     ```sh
     aws s3 cp s3://nyc-tlc/trip\ data/ s3://${SERVERLESS_BUCKET_NAME}/nyc-taxi/ --exclude "*" --include "yellow_tripdata_2021-*.parquet" --recursive --profile ${PROFILE_NAME}
     ```
  3. **Create a Python script for processing Delta Lake**

     ```sh
     touch ${DELTA_LAKE_SCRIPT_NAME}.py
     cat << EOF > ${DELTA_LAKE_SCRIPT_NAME}.py
     from pyspark.sql import SparkSession
     import uuid

     if __name__ == "__main__":
         """
             Delta Lake with EMR Serverless, take NYC taxi as example.
         """
         spark = SparkSession \\
             .builder \\
             .config("spark.sql.extensions", "io.delta.sql.DeltaSparkSessionExtension") \\
             .config("spark.sql.catalog.spark_catalog", "org.apache.spark.sql.delta.catalog.DeltaCatalog") \\
             .enableHiveSupport() \\
             .appName("Delta-Lake-OSS") \\
             .getOrCreate()

         url = "s3://${SERVERLESS_BUCKET_NAME}/emr-serverless-spark/delta-lake/output/1.2.1/%s/" % str(
             uuid.uuid4())

         
         spark.range(5).write.format("delta").save(url)

         
         spark.read.format("delta").load(url).show()

         
         base = spark.read.parquet(
             "s3://${SERVERLESS_BUCKET_NAME}/nyc-taxi/*.parquet")

         
         base.write.format("delta") \\
             .mode("overwrite") \\
             .save("s3://${SERVERLESS_BUCKET_NAME}/emr-serverless-spark/delta-lake/nyx-tlc-2021")
         spark.stop()
     EOF
     ```
  4. **Upload the script and required jars into the serverless bucket**

     ```sh
     
     aws s3 cp delta-lake-demo.py s3://${SERVERLESS_BUCKET_NAME}/scripts/${DELTA_LAKE_SCRIPT_NAME}.py --profile ${PROFILE_NAME}
     
     DELTA_VERSION="3.0.0"
     DELTA_LAKE_CORE="delta-spark_2.13-${DELTA_VERSION}.jar"
     DELTA_LAKE_STORAGE="delta-storage-${DELTA_VERSION}.jar"
     curl https://repo1.maven.org/maven2/io/delta/delta-spark_2.13/${DELTA_VERSION}/${DELTA_LAKE_CORE} --output ${DELTA_LAKE_CORE}
     curl https://repo1.maven.org/maven2/io/delta/delta-storage/${DELTA_VERSION}/${DELTA_LAKE_STORAGE} --output ${DELTA_LAKE_STORAGE}
     aws s3 mv ${DELTA_LAKE_CORE} s3://${SERVERLESS_BUCKET_NAME}/jars/${DELTA_LAKE_CORE} --profile ${PROFILE_NAME}
     aws s3 mv ${DELTA_LAKE_STORAGE} s3://${SERVERLESS_BUCKET_NAME}/jars/${DELTA_LAKE_STORAGE} --profile ${PROFILE_NAME}
     ```



  Rememeber, you got so much information to copy and paste from the CloudFormation outputs.
  ![cfn outputs](https://raw.githubusercontent.com/HsiehShuJeng/cdk-emrserverless-with-delta-lake/main/images/cfn-outputs.png)

  ```sh
  aws emr-serverless start-job-run \
    --application-id ${APPLICATION_ID} \
    --execution-role-arn ${JOB_ROLE_ARN} \
    --name 'shy-shy-first-time' \
    --job-driver '{
          "sparkSubmit": {
              "entryPoint": "s3://'${SERVERLESS_BUCKET_NAME}'/scripts/'${DELTA_LAKE_SCRIPT_NAME}'.py",
              "sparkSubmitParameters": "--conf spark.executor.cores=1 --conf spark.executor.memory=4g --conf spark.driver.cores=1 --conf spark.driver.memory=4g --conf spark.executor.instances=1 --conf spark.jars=s3://'${SERVERLESS_BUCKET_NAME}'/jars/'${DELTA_LAKE_CORE}',s3://'${SERVERLESS_BUCKET_NAME}'/jars/'${DELTA_LAKE_STORAGE}'"
          }
      }' \
    --configuration-overrides '{
          "monitoringConfiguration": {
              "s3MonitoringConfiguration": {
                  "logUri": "s3://'${SERVERLESS_BUCKET_NAME}'/serverless-log/"
  	        }
  	    }
  	}' \
  	--profile ${PROFILE_NAME}
  ```

  If you execute with success, you should see similar reponse as the following:

  ```sh
  {
      "applicationId": "00f1gvklchoqru25",
      "jobRunId": "00f1h0ipd2maem01",
      "arn": "arn:aws:emr-serverless:ap-northeast-1:630778274080:/applications/00f1gvklchoqru25/jobruns/00f1h0ipd2maem01"
  }
  ```

  and got a Delta Lake data under `s3://${SERVERLESS_BUCKET_NAME}/emr-serverless-spark/delta-lake/nyx-tlc-2021/`.
  ![Delta Lake data](https://raw.githubusercontent.com/HsiehShuJeng/cdk-emrserverless-with-delta-lake/main/images/delta%20lake%20data.png)



  Access the EMR Studio via the URL from the CloudFormation outputs. It should look very similar to the following url: `https://es-pilibalapilibala.emrstudio-prod.ap-northeast-1.amazonaws.com`, i.e., weird string and region won't be the same as mine.

  1. **Enter into the application**
     ![enter into the app](https://raw.githubusercontent.com/HsiehShuJeng/cdk-emrserverless-with-delta-lake/main/images/enter-serverless-app.png)
  2. **Enter into the executing job**



  1. Create a workspace and an EMR cluster via the cluster template on the AWS Console
     ![create workspace](https://raw.githubusercontent.com/HsiehShuJeng/cdk-emrserverless-with-delta-lake/main/images/create%20workspace.png)
  2. Check the results delivered by the EMR serverless application via an EMR notebook.



  1. You can assign multiple jars as a comma-separated list to the `spark.jars` as [the Spark page](https://spark.apache.org/docs/latest/configuration.html#runtime-environment) says for your EMR Serverless job. The UI will complain, you still can start the job. Don't be afraid, just click it like when you were child, facing authority fearlessly.
     ![ui bug](https://raw.githubusercontent.com/HsiehShuJeng/cdk-emrserverless-with-delta-lake/main/images/ui-bug.png)
  2. To fully delet a stack with the construct, you need to make sure there is no more workspace within the EMR Studio. Aside from that, you also need to remove the associated identity from the Service Catalog (this is a necessary resource for the cluster template).
  3. Version inconsistency on Spark history. Possibly it can be ignored yet still made me wonder why the versions are different.
     ![naughty inconsistency](https://raw.githubusercontent.com/HsiehShuJeng/cdk-emrserverless-with-delta-lake/main/images/Spark%20history.png)
  4. So far, I still haven't figured out how to make the s3a URI work. The s3 URI is fine while the serverless app will complain that it couldn't find proper credentials provider to read the s3a URI.



  1. Custom resuorce for EMR Serverless
  2. Make the construct more flexible for users
  3. Compare Databricks Runtime and EMR Serverless.


pkgId: 09a1355b3def148fa84746ceacb20b4f5199e6eec9ca233d9f13fc3ef5b57b47
name: python-cdk-events-notify
arch: src
version: 2.2.295
epoch: 0
release: 1
summary: The Events Notify AWS Construct lib for AWS CDK
url: https://github.com/neilkuan/cdk-events-notify.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-events-notify-2.2.295-1.src.rpm
checksum_type: sha256
description:
  [![NPM version](https://badge.fury.io/js/cdk-events-notify.svg)](https://badge.fury.io/js/cdk-events-notify)
  [![PyPI version](https://badge.fury.io/py/cdk-events-notify.svg)](https://badge.fury.io/py/cdk-events-notify)
  ![Release](https://github.com/neilkuan/cdk-s3bucket/workflows/release/badge.svg)

  ![Downloads](https://img.shields.io/badge/-DOWNLOADS:-brightgreen?color=gray)
  ![npm](https://img.shields.io/npm/dt/cdk-events-notify?label=npm&color=orange)
  ![PyPI](https://img.shields.io/pypi/dm/cdk-events-notify?label=pypi&color=blue)



  `cdk-events-notify` is an AWS CDK Construct Library that provides you know who login in your aws console.



  It’s just a small feature at the moment,
  Provides you to trigger Lambda Function push notifications to Line Notify or Slack when you discover Console Login event or swith role event through Cloudtrail.

  > Welcome to contribute another event notify case you want.



  ![](./images/overview.png)



  * Line Notify
  * Slack ([webhooks](https://api.slack.com/messaging/webhooks#posting_with_webhooks))



  > more see https://aws.amazon.com/tw/cloudtrail/pricing/
  > ![](./images/management-events.png)



  > more see [line notify docs](https://notify-bot.line.me/doc/en/)

  ![](./images/access-token.png)



  ```bash
  Use the npm dist tag to opt in CDKv1 or CDKv2:

  // for CDKv2
  npm install cdk-events-notify
  or
  npm install cdk-events-notify@latest
  ```





  ```python
  import * as cdk from 'aws-cdk-lib';
  import { EventNotify } from 'cdk-events-notify';

  const app = new cdk.App();
  const stack = new cdk.Stack(app, 'integ-stack', { env });
  new EventNotify(stack, 'LineEventNotify', { lineNotifyToken: process.env.LINE_NOTIFY_TOKEN });
  ```



  ```bash
  cdk deploy
  ```



  ```bash
  cdk destroy
  ```



  * line
    ![](./images/line-chat.jpg)
  * slack
    ![](./images/slack.jpg)



  * [EventBridge](https://docs.aws.amazon.com/eventbridge/latest/userguide/aws-events.html)
  * [Lambda](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html)

  > Note: Event Bridge can not cross region , if you console sign in not the cdk-events-notify region will not get the evnet in cloudtrail see this [docs](https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html#cloudtrail-integration_signin-regions)



  [![Stargazers repo roster for @neilkuan/cdk-events-notify](https://reporoster.com/stars/neilkuan/cdk-events-notify)](https://github.com/neilkuan/cdk-events-notify/stargazers)
  [![Forkers repo roster for @neilkuan/cdk-events-notify](https://reporoster.com/forks/neilkuan/cdk-events-notify)](https://github.com/neilkuan/cdk-events-notify/network/members)


pkgId: 297dfafa7ff160664620fa860a252b0e319cd6b7148655261eba0df9e4b595c3
name: python-cdk-extensions
arch: src
version: 0.0.96
epoch: 0
release: 1
summary: cdk-extensions
url: https://github.com/vibe-io/cdk-extensions.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-extensions-0.0.96-1.src.rpm
checksum_type: sha256
description:
  Vibe.io CDK extensions is a library of opinionated CDK constructs that will accelerate your project by laying a solid cloud foundation for your team to build on top of. Keeping your team focused on business value, while relying on a community to manage the common fundamentals like VPC, EKS, Cross Account Management, etc.



  [RightBrain Networks](https://www.rightbrainnetworks.com/) has spent the past decade forging cloud patterns, working with startups and enterprise clients to find the sweet spot where cloud infrastructure sits in a Software Development LifeCycle (SDLC). Identifying the right amount of self-service to unblock development, but with the right amount of support from operations to ensure we're building a secure, and auditable platform. We've found that the CDK construct library pattern lends itself in line with our goals, and provides a framework for adoption that enables us to share our work with the cloud operations community.

  We are confident in our vision that Infrastructure as Code should follow an [Environments as Cattle approach](https://www.youtube.com/watch?v=z5XDAhyh9Z4). We've attempted to open source our patterns many times throughout the years, by way of CloudFormation repositories and troposphere initiatives and the like. CDK broke this wide open for us. We're able to develop and iterate on our patterns with true imperative code, that can be imported as a library by a consumer and used as necessary.



  Use the GitHub issues to address problems



  Email: joe@rightbrainetworks.com

  ![Joe Coleman](./images/joe.webp)







  ```shell
  $ npm install cdk-extensions
  ```





  ```shell
  $ pip install cdk-extensions
  ```





  Minimal deployable example creates the default logging strategy defined in [AwsLoggingStack](src/stacks/README.md#awsloggingstack) for Elastic Load Balancer, CloudFront, CloudTrail, VPC Flow Logs, S3 access logs, SES logs, and WAF logs. For each service, an S3 bucket is created and a Glue crawler to analyze and categorize the data and store the associated metadata in the AWS Glue Data Catalog. Default named queries have been defined for each AWS service. For more details on this and the other available stacks and constructs, consult the respective READMEs.

  **TypeScript**

  ```TypeScript
  import { AwsLoggingStack } from 'cdk-extensions/stacks';
  ```

  ```TypeScript
  new AwsLoggingStack(this, 'AwsLoggingStack')
  ```

  **Python**

  ```Python
  from cdk_extensions.stacks import (
    AwsLoggingStack
  )
  ```

  ```Python
  aws_logging_stack = AwsLoggingStack(self, 'AwsLoggingStack')
  ```



  ```shell
  $ cdk deploy
  ```





  * Expose their configurations so other resources can make informed
    decisions about the resource it’s working on.
  * Be fully compatible with **aws-cdk-lib** constructs
  * Expose every single field in the resources, so they can be configured

    * In some cases, this may rely on custom features built into the **cdk-extensions**
      constructs, to allow configuration of Cfn fields not normally exposed by CDK
    * Anything that can be configured on a resource should be something that can
      be customized using CDK
  * However, all fields have sane defaults, following best practices(i.e most secure way)

    * Using the most secure settings should be a feature one opts out of, not the
      other way around
    * We should be able to launch constructs that adhere to best practices without
      a lot of customization


pkgId: d2182b1cad6aa08bd91c968c3631f6b024816993ba9dd129e5d6752a36137921
name: python-cdk-fargate-fastautoscaler
arch: src
version: 0.2.97
epoch: 0
release: 1
summary: A JSII construct lib to build AWS Fargate Fast Autoscaler
url: https://github.com/aws-samples/aws-fargate-fast-autoscaler.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-fargate-fastautoscaler-0.2.97-1.src.rpm
checksum_type: sha256
description:
  [![NPM version](https://badge.fury.io/js/cdk-fargate-fastautoscaler.svg)](https://badge.fury.io/js/cdk-fargate-fastautoscaler)
  [![PyPI version](https://badge.fury.io/py/cdk-fargate-fastautoscaler.svg)](https://badge.fury.io/py/cdk-fargate-fastautoscaler)
  [![build](https://github.com/aws-samples/aws-fargate-fast-autoscaler/actions/workflows/build.yml/badge.svg)](https://github.com/aws-samples/aws-fargate-fast-autoscaler/actions/workflows/build.yml)



  **AWS Fargate Fast Autosaler** - A Serverless Implementation that Triggers your AWS Fargate autoscaling in seconds with `cdk-fargate-fastautoscaler`.



  `cdk-fargate-fastautoscaler` is a [aws/jsii](https://github.com/aws/jsii) construct library for AWS CDK.

  By building your AWS CDK stacks with `cdk-fargate-fastautoscaler`, you can create your customized Fargate workload with the fast autoscaling capabilities.

  ![](images/fargate-fast-autoscaler.png)



  Behind the scene, our workload in PHP, NodeJS, Java or Python is running with a nginx reverse proxy within a single AWS Fargate Task exposing a `/nginx_status` endpoint for realtime connections info generation. All traffic coming through ALB to Fargate tasks will establish active connecitons with the nginx reverse proxy before it can hit our backend server.

  We are running an AWS Step Function state machine to periodically invoke the AWS Lambda function and collect active connection numbers from each Fargate Task **every 3 seconds** and determine our scaling policy in the state machine followed by immediate `ecs service update` to increase the desired number of Fargate tasks.



  The following CDK sample creates a PHP service in AWS Fargate with the nginx as the reverse proxy.

  ```python
  import * as cdk from '@aws-cdk/core'
  import * as ec2 from '@aws-cdk/aws-ec2';
  import { AwsLogDriver, ContainerImage } from '@aws-cdk/aws-ecs';
  import { FargateFastAutoscaler } from 'cdk-fargate-fastautoscaler';
  import * as path from 'path';

  const app = new cdk.App()

  const env = {
    region: process.env.CDK_DEFAULT_REGION,
    account: process.env.CDK_DEFAULT_ACCOUNT,
  };

  const stack = new cdk.Stack(app, 'FargateFastAutoscalerDemo', { env })

  const vpc = ec2.Vpc.fromLookup(stack, 'Vpc', { isDefault: true })

  new FargateFastAutoscaler(stack, 'FargateFastAutoscaler', {
    vpc,
    // create the backend PHP service
    backendContainer: {
      image: ContainerImage.fromAsset(path.join(__dirname, '../../sample/backend/php')),
    },
    // PHP service running on container port 2015
    backendContainerPortMapping: [ { containerPort: 2015 } ],
  })
  ```

  On deployment complete, you'll see the URL in the Outputs:

  **fargate-fast-autoscaling.URL** = http://farga-exter-1GW64WGQYNE4O-1567742142.us-west-2.elb.amazonaws.com

  Open this URL and you will see the Caddy web server welcome page with phpinfo.

  ![](images/php-welcome.png)

  And if you append `/nginx_status` in the URL and reload the page, you'll see this page:

  ![](images/nginx-status.png)



  Go to Step Function console and click **start execution** on the state machines. Leave the execution name and input column as is and click **start execution** again. Your state machine will be running. Behind the scene the step function will invoke a Lambda function to collect **Active Connections** number from nginx reverse proxy on each fargate task and determine a new desired number of fargate tasks to scale. Typically it would just take **less than 10 seconds** before it starts to scale.

  ![](images/stepfunc.png)



  The **SNSScaleOut** task in the state machine leverages direct Amazon SNS service integration to publish a notification to your SNS topic. You will receive SNS notification when it starts **ServiceScaleOut** task.

  Specify the `snsTopic` property to define your custom SNS topic. If not defined, the construct will create a default SNS topic.



  By default, `disableScaleIn` is set to true to prevent your workload from scale-in. If you prefer to enable scale in, set `disableScaleIn` to `false`.



  This sample code is made available under the MIT-0 license. See the LICENSE file.


pkgId: 9b9182ab00743290457a3e4f4634dd1b743cbd0e49b6b4d4bbc4e8da42bed185
name: python-cdk-fargate-run-task
arch: src
version: 2.0.397
epoch: 0
release: 1
summary: Define and run container tasks on AWS Fargate immediately or with schedule
url: https://github.com/pahud/cdk-fargate-run-task.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-fargate-run-task-2.0.397-1.src.rpm
checksum_type: sha256
description:
  [![NPM version](https://badge.fury.io/js/cdk-fargate-run-task.svg)](https://badge.fury.io/js/cdk-fargate-run-task)
  [![PyPI version](https://badge.fury.io/py/cdk-fargate-run-task.svg)](https://badge.fury.io/py/cdk-fargate-run-task)
  [![build](https://github.com/pahud/cdk-fargate-run-task/actions/workflows/build.yml/badge.svg)](https://github.com/pahud/cdk-fargate-run-task/actions/workflows/build.yml)



  Define and run container tasks on AWS Fargate at once or by schedule.



  ```python
  const app = new cdk.App();

  const env = {
    account: process.env.CDK_DEFAULT_ACCOUNT,
    region: process.env.CDK_DEFAULT_REGION,
  };

  const stack = new cdk.Stack(app, 'run-task-demo-stack', { env });

  // define your task
  const task = new ecs.FargateTaskDefinition(stack, 'Task', { cpu: 256, memoryLimitMiB: 512 });

  // add contianer into the task
  task.addContainer('Ping', {
    image: ecs.ContainerImage.fromRegistry('busybox'),
    command: [
      'sh', '-c',
      'ping -c 3 google.com',
    ],
    logging: new ecs.AwsLogDriver({
      streamPrefix: 'Ping',
      logGroup: new LogGroup(stack, 'LogGroup', {
        logGroupName: `${stack.stackName}LogGroup`,
        retention: RetentionDays.ONE_DAY,
      }),
    }),
  });

  // deploy and run this task once
  const runTaskAtOnce = new RunTask(stack, 'RunDemoTaskOnce', { task });

  // or run it with schedule(every hour 0min)
  new RunTask(stack, 'RunDemoTaskEveryHour', {
    task,
    cluster: runTaskAtOnce.cluster,
    runOnce: false,
    schedule: Schedule.cron({ minute: '0' }),
  });
  ```



  To run task in public subnets only VPC:

  ```python
  new RunTask(stack, 'RunTask', {
    task,
    vpcSubnets: {
      subnetType: ec2.SubnetType.PUBLIC,
    },
  ```



  [Amazon ECS Anywhere](https://aws.amazon.com/ecs/anywhere/) allows you to run ECS tasks on external instances. To run external task once or on schedule:

  ```python
  const externalTask = new ecs.TaskDefinition(stack, 'ExternalTask', {
    cpu: '256',
    memoryMiB: '512',
    compatibility: ecs.Compatibility.EXTERNAL,
  });

  externalTask.addContainer('ExternalPing', {
    image: ecs.ContainerImage.fromRegistry('busybox'),
    command: [
      'sh', '-c',
      'ping -c 3 google.com',
    ],
    logging: new ecs.AwsLogDriver({
      streamPrefix: 'Ping',
      logGroup: new LogGroup(stack, 'ExternalLogGroup', {
        retention: RetentionDays.ONE_DAY,
        removalPolicy: cdk.RemovalPolicy.DESTROY,
      }),
    }),
  });

  // run it once on external instance
  new RunTask(stack, 'RunDemoTaskFromExternal', {
    task: externalTask,
    cluster: existingCluster,
    launchType: LaunchType.EXTERNAL,
  });

  // run it by schedule  on external instance
  new RunTask(stack, 'RunDemoTaskFromExternalSchedule', {
    task: externalTask,
    cluster: existingCluster,
    launchType: LaunchType.EXTERNAL,
    runAtOnce: false,
    schedule: Schedule.cron({ minute: '0' }),
  });
  ```

  Please note when you run task in `EXTERNAL` launch type, no fargate tasks will be scheduled. You will be responsible to register the external instances to your ECS cluster. See [Registering an external instance to a cluster](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-anywhere-registration.html) for more details.


pkgId: 51ea8c218e91db58c94f65b9dee0fab50340fa8c6123c02b723a6e5d3280d574
name: python-cdk-fck-nat
arch: src
version: 1.5.11
epoch: 0
release: 1
summary: A NAT Gateway instance construct built on the fck-nat AMI.
url: https://github.com/AndrewGuenther/cdk-fck-nat.git
rpm_license: MIT
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-fck-nat-1.5.11-1.src.rpm
checksum_type: sha256
description:
  A CDK construct for deploying NAT Instances using [fck-nat](https://github.com/AndrewGuenther/fck-nat). The (f)easible (c)ost (k)onfigurable NAT!

  * Overpaying for AWS Managed NAT Gateways? fck-nat.
  * Want to use NAT instances and stay up-to-date with the latest security patches? fck-nat.
  * Want to reuse your Bastion hosts as a NAT? fck-nat.

  fck-nat offers a ready-to-use ARM and x86 based AMIs built on Amazon Linux 2023 which can support up to 5Gbps NAT traffic
  on a t4g.nano instance. How does that compare to a Managed NAT Gateway?

  Hourly rates:

  * Managed NAT Gateway hourly: $0.045
  * t4g.nano hourly: $0.0042

  Per GB rates:

  * Managed NAT Gateway per GB: $0.045
  * fck-nat per GB: $0.00

  Sitting idle, fck-nat costs 10% of a Managed NAT Gateway. In practice, the savings are even greater.

  *"But what about AWS' NAT Instance AMI?"*

  The official AWS supported NAT Instance AMI hasn't been updates since 2018, is still running Amazon Linux 1 which is
  now EOL, and has no ARM support, meaning it can't be deployed on EC2's most cost effective instance types. fck-nat.

  *"When would I want to use a Managed NAT Gateway instead of fck-nat?"*

  AWS limits outgoing internet bandwidth on EC2 instances to 5Gbps. This means that the highest bandwidth that fck-nat
  can support is 5Gbps. This is enough to cover a very broad set of use cases, but if you need additional bandwidth,
  you should use Managed NAT Gateway. If AWS were to lift the limit on internet egress bandwidth from EC2, you could
  cost-effectively operate fck-nat at speeds up to 25Gbps, but you wouldn't need Managed NAT Gateway then would you?
  fck-nat.

  Read more about EC2 bandwidth limits here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-network-bandwidth.html


pkgId: e8ac99cb484547efe9521da7cfb37166cafca52992ea97499419e729b24f160d
name: python-cdk-gitlab
arch: src
version: 2.0.241
epoch: 0
release: 1
summary: High level CDK construct to provision GitLab integrations with AWS
url: https://github.com/pahud/cdk-gitlab.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-gitlab-2.0.241-1.src.rpm
checksum_type: sha256
description:
  [![NPM version](https://badge.fury.io/js/cdk-gitlab.svg)](https://badge.fury.io/js/cdk-gitlab)
  [![PyPI version](https://badge.fury.io/py/cdk-gitlab.svg)](https://badge.fury.io/py/cdk-gitlab)
  [![release](https://github.com/pahud/cdk-gitlab/actions/workflows/release.yml/badge.svg)](https://github.com/pahud/cdk-gitlab/actions/workflows/release.yml)



  High level CDK construct to provision GitLab integrations with AWS



  Use the npm dist tag to opt in CDKv1 or CDKv2:

  ```sh
  // for CDKv2
  npm install cdk-gitlab
  or
  npm install cdk-gitlab@latest

  // for CDKv1
  npm install cdk-gitlab@cdkv1
  ```



  ```python
  import { Provider, FargateJobExecutor, FargateRunner, JobExecutorImage } from 'cdk-gitlab';

  const provider = new Provider(stack, 'GitlabProvider', { vpc });

  // create a Amazon EKS cluster
  provider.createFargateEksCluster(stack, 'GitlabEksCluster', {
    clusterOptions: {
      vpc,
      version: eks.KubernetesVersion.V1_19,
    },
  });

  // create a default fargate runner with its job executor
  provider.createFargateRunner();

  // alternatively, create the runner and the executor indivicually.
  // first, create the executor
  const executor = new FargateJobExecutor(stack, 'JobExecutor', {
    image: JobExecutorImage.DEBIAN,
  });

  // second, create the runner with the task definition of the executor
  new FargateRunner(stack, 'FargateRunner', {
    vpc,
    executor,
  });

  // TBD - create Amazon EC2 runner for the GitLab
  provider.createEc2Runner(...);

  });
  ```



  On deployment with `createFargateRunner()`, the **Fargate Runner** will be provisioned in Amazon ECS with AWS Fargate and [Amazon ECS Capacity Providers](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-capacity-providers.html). By default, the `FARGATE` and `FARGATE_SPOT` capacity providers are available for the Amazon ECS cluster and the runner and job executor will run on `FARGATE_SPOT`. You can specify your custom `clusterDefaultCapacityProviderStrategy` and `serviceDefaultCapacityProviderStrategy` properties from the `FargateRunner` construct for different capacity provider strategies.



  ```sh
  cdk deploy -c GITLAB_REGISTRATION_TOKEN=<TOKEN>
  ```


pkgId: 18292ce5f2caea0ff5e1def2eabdfb89abf71c1fc45a6d237280b3363882a504
name: python-cdk-gitlab-runner
arch: src
version: 2.2.323
epoch: 0
release: 1
url: https://github.com/neilkuan/cdk-gitlab-runner.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-gitlab-runner-2.2.323-1.src.rpm
checksum_type: sha256
summary:
  Use AWS CDK to create a gitlab runner, and use gitlab runner to help you execute your Gitlab pipeline job.

description:
  [![NPM version](https://badge.fury.io/js/cdk-gitlab-runner.svg)](https://badge.fury.io/js/cdk-gitlab-runner)
  [![PyPI version](https://badge.fury.io/py/cdk-gitlab-runner.svg)](https://badge.fury.io/py/cdk-gitlab-runner)
  [![release](https://github.com/neilkuan/cdk-gitlab-runner/actions/workflows/release.yml/badge.svg)](https://github.com/neilkuan/cdk-gitlab-runner/actions/workflows/release.yml)

  ![Downloads](https://img.shields.io/badge/-DOWNLOADS:-brightgreen?color=gray)
  ![npm](https://img.shields.io/npm/dt/cdk-gitlab-runner?label=npm&color=orange)
  ![PyPI](https://img.shields.io/pypi/dm/cdk-gitlab-runner?label=pypi&color=blue)

  ![](https://img.shields.io/badge/iam_role_self-enable-green=?style=plastic&logo=appveyor)
  ![](https://img.shields.io/badge/vpc_self-enable-green=?style=plastic&logo=appveyor)
  ![](https://img.shields.io/badge/gitlab_url-customize-green=?style=plastic&logo=appveyor)
  ![](https://img.shields.io/badge/spotfleet-runner-green=?style=plastic&logo=appveyor)



  Use AWS CDK to create gitlab runner, and use [gitlab runner](https://gitlab.com/gitlab-org/gitlab-runner) to help you execute your Gitlab Pipeline Job.

  > GitLab Runner is the open source project that is used to run your CI/CD jobs and send the results back to GitLab. [(source repo)](https://gitlab.com/gitlab-org/gitlab-runner)



  Gitlab provides [400 minutes per month for each free user](https://about.gitlab.com/pricing/), hosted Gitlab Runner to execute your gitlab pipeline job.That's pretty good and users don't need to manage gitlab runner. If it is just a simple ci job for test 400, it may be enough.
  But what if you want to deploy to your AWS production environment through pipeline job?
  Is there any security consideration for using the hosted gitlab runner?!

  But creating Gitlab Runner is not that simple, so I created this OSS so that you can quickly create Gitlab Runner and delete your Gitlab Runner via AWS CDK.
  It will be used with AWS IAM Role, so you don't need to put AKSK in Gitlab environment variables.

  ![](./image/cdk-gitlab-runner.png)





  * VPC

    * Public Subnet (2)
  * EC2 (1 T3.micro)





  This registration process is only supported in GitLab Runner 15.10 or later
  This registration process is not supported in GitLab Runner 15.9 or earlier and only available as an experimental feature in GitLab Runner 15.10 and 15.11. You should upgrade to GitLab Runner 16.0 or later to use a stable version of this registration process. [Check this issue](https://github.com/neilkuan/cdk-gitlab-runner/issues/1796)

  Group > Settings > CI/CD
  ![group](image/group_runner_page.png)



  This registration process is only supported in GitLab Runner 15.10 or later
  This registration process is not supported in GitLab Runner 15.9 or earlier and only available as an experimental feature in GitLab Runner 15.10 and 15.11. You should upgrade to GitLab Runner 16.0 or later to use a stable version of this registration process. [Check this issue](https://github.com/neilkuan/cdk-gitlab-runner/issues/1796)

  Group > Build > Runners
  ![group](image/gitlab-runner-new-register.png)
  ![group](image/gitlab-runner-new-register-1.png)
  ![group](image/gitlab-runner-new-register-2.png)
  ![group](image/gitlab-runner-new-register-3.jpg)



  This registration process is only supported in GitLab Runner 15.10 or later
  This registration process is not supported in GitLab Runner 15.9 or earlier and only available as an experimental feature in GitLab Runner 15.10 and 15.11. You should upgrade to GitLab Runner 16.0 or later to use a stable version of this registration process. [Check this issue](https://github.com/neilkuan/cdk-gitlab-runner/issues/1796)

  Project > Settings > CI/CD > Runners
  ![project](image/project_runner_page.png)



  This registration process is only supported in GitLab Runner 15.10 or later
  This registration process is not supported in GitLab Runner 15.9 or earlier and only available as an experimental feature in GitLab Runner 15.10 and 15.11. You should upgrade to GitLab Runner 16.0 or later to use a stable version of this registration process. [Check this issue](https://github.com/neilkuan/cdk-gitlab-runner/issues/1796)

  Project > Settings > CI/CD > Runners
  ![project](image/gitlab-runner-new-register-project.png)



  Replace your gitlab runner token in `$GITLABTOKEN`



  Use the npm dist tag to opt in CDKv1 or CDKv2:

  ```bash
  // for CDKv2
  npm install cdk-gitlab-runner
  or
  npm install cdk-gitlab-runner@latest

  // for CDKv1
  npm install cdk-gitlab-runner@cdkv1
  ```





  ```python
  import { GitlabContainerRunner } from 'cdk-gitlab-runner';

  // If want change instance type to t3.large .
  new GitlabContainerRunner(this, 'runner-instance', { gitlabtoken: 'glrt-GITLABTOKEN', ec2type:'t3.large',gitlabRunnerVersion: '15.10' });
  // OR
  // Just create a gitlab runner , by default instance type is t3.micro .
  import { GitlabContainerRunner } from 'cdk-gitlab-runner';

  new GitlabContainerRunner(this, 'runner-instance', { gitlabtoken: 'glrt-GITLABTOKEN', gitlabRunnerVersion: '15.10' });
  ```



  If you want change what you want tag name .

  ```python
  // If you want change  what  your self Gitlab Server Url .
  import { GitlabContainerRunner } from 'cdk-gitlab-runner';

  new GitlabContainerRunner(this, 'runner-instance-change-tag', {
    gitlabtoken: 'glrt-GITLABTOKEN',
    gitlaburl: 'https://gitlab.my.com/',
    gitlabRunnerVersion: '15.10'
  });
  ```



  If you want change what you want tag name .
  !!! Not support Gitlab Runner 15.10 and later !!!

  ```python
  // If you want change  what  you want tag name .
  import { GitlabContainerRunner } from 'cdk-gitlab-runner';

  new GitlabContainerRunner(this, 'runner-instance-change-tag', {
    gitlabtoken: 'glrt-GITLABTOKEN',
    gitlabRunnerVersion: '15.10',
    tags: ['aa', 'bb', 'cc'],
  });
  ```



  If you want add runner other IAM Policy like s3-readonly-access.

  ```python
  // If you want add runner other IAM Policy like s3-readonly-access.
  import { GitlabContainerRunner } from 'cdk-gitlab-runner';
  import { ManagedPolicy } from 'aws-cdk-lib/aws-iam';

  const runner = new GitlabContainerRunner(this, 'runner-instance-add-policy', {
    gitlabtoken: 'glrt-GITLABTOKEN',
    gitlabRunnerVersion: '15.10',
    tags: ['aa', 'bb', 'cc'],
  });
  runner.runnerRole.addManagedPolicy(
    ManagedPolicy.fromAwsManagedPolicyName('AmazonS3ReadOnlyAccess'),
  );
  ```



  If you want add runner other SG Ingress .

  ```python
  // If you want add runner other SG Ingress .
  import { GitlabContainerRunner } from 'cdk-gitlab-runner';
  import { Port, Peer } from 'aws-cdk-lib/aws-ec2';

  const runner = new GitlabContainerRunner(this, 'runner-add-SG-ingress', {
    gitlabtoken: 'glrt-GITLABTOKEN',
    gitlabRunnerVersion: '15.10',
    tags: ['aa', 'bb', 'cc'],
  });

  // you can add ingress in your runner SG .
  runner.defaultRunnerSG.connections.allowFrom(
    Peer.ipv4('0.0.0.0/0'),
    Port.tcp(80),
  );
  ```



  > 2020/06/27 , you can use your self exist VPC or new VPC , but please check your `vpc public Subnet` Auto-assign public IPv4 address must be Yes ,or `vpc private Subnet` route table associated `nat gateway` .

  ```python
  import { GitlabContainerRunner } from 'cdk-gitlab-runner';
  import { Port, Peer, Vpc, SubnetType } from 'aws-cdk-lib/aws-ec2';
  import { ManagedPolicy } from 'aws-cdk-lib/aws-iam';

  const newvpc = new Vpc(stack, 'VPC', {
    ipAddresses: IpAddresses.cidr('10.0.0.0/16'),
    maxAzs: 2,
    subnetConfiguration: [
      {
        cidrMask: 26,
        name: 'RunnerVPC',
        subnetType: SubnetType.PUBLIC,
      },
    ],
    natGateways: 0,
  });

  const runner = new GitlabContainerRunner(this, 'testing', {
    gitlabtoken: 'glrt-GITLABTOKEN',
    gitlabRunnerVersion: '15.10',
    ec2type: 't3.small',
    selfvpc: newvpc,
  });
  ```



  > 2020/06/27 , you can use your self exist role assign to runner

  ```python
  import { GitlabContainerRunner } from 'cdk-gitlab-runner';
  import { Port, Peer } from 'aws-cdk-lib/aws-ec2';
  import { ManagedPolicy, Role, ServicePrincipal } from 'aws-cdk-lib/aws-iam';

  const role = new Role(this, 'runner-role', {
    assumedBy: new ServicePrincipal('ec2.amazonaws.com'),
    description: 'For Gitlab EC2 Runner Test Role',
    roleName: 'TestRole',
  });

  const runner = new GitlabContainerRunner(stack, 'testing', {
    gitlabtoken: 'glrt-GITLABTOKEN',
    gitlabRunnerVersion: '15.10',
    ec2iamrole: role,
  });
  runner.runnerRole.addManagedPolicy(
    ManagedPolicy.fromAwsManagedPolicyName('AmazonS3ReadOnlyAccess'),
  );
  ```



  > 2020/08/22 , you can change you want ebs size.

  ```python
  import { GitlabContainerRunner } from 'cdk-gitlab-runner';

  new GitlabContainerRunner(stack, 'testing', {
    gitlabtoken: 'glrt-GITLABTOKEN',
    gitlabRunnerVersion: '15.10',
    ebsSize: 50,
  });
  ```



  > 2020/11/25 , you can set the number of runners.

  ```python
  import { GitlabRunnerAutoscaling } from 'cdk-gitlab-runner';

  new GitlabRunnerAutoscaling(stack, 'testing', {
    gitlabToken: 'glrt-GITLABTOKEN',
    gitlabRunnerVersion: '15.10',
    minCapacity: 2,
    maxCapacity: 2,
  });
  ```



  > 2020/08/27 , you can use spotfleet instance be your gitlab runner,
  > after create spotfleet instance will auto output instance id.

  ```python
  import { GitlabContainerRunner, BlockDuration } from 'cdk-gitlab-runner';

  const runner = new GitlabContainerRunner(stack, 'testing', {
    gitlabToken: 'glrt-GITLABTOKEN',
    gitlabRunnerVersion: '15.10',
    ec2type: 't3.large',
    spotFleet: true,
  });
  // configure the expiration after 1 hours
  runner.expireAfter(Duration.hours(1));
  ```

  > 2020/11/19, you setting job runtime bind host volumes.
  > see more https://docs.gitlab.com/runner/configuration/advanced-configuration.html#the-runnersdocker-section

  ```python
  import { GitlabContainerRunner, BlockDuration } from 'cdk-gitlab-runner';

  const runner = new GitlabContainerRunner(stack, 'testing', {
    gitlabToken: 'glrt-GITLABTOKEN',
    gitlabRunnerVersion: '15.10',
    ec2type: 't3.large',
    dockerVolumes: [
      {
        hostPath: '/tmp/cache',
        containerPath: '/tmp/cache',
      },
    ],
  });
  ```



  ![runner](image/group_runner2.png)



  > !!!!! Not Support Gitlab Runner after 15.10 and later



  [gitlab docs see more ...](https://docs.gitlab.com/ee/ci/yaml/README.html)

  ```yaml
  dockerjob:
    image: docker:18.09-dind
    variables:
    tags:
      - runner
      - awscdk
      - gitlab
    variables:
      DOCKER_TLS_CERTDIR: ""
    before_script:
      - docker info
    script:
      - docker info;
      - echo 'test 123';
      - echo 'hello world 1228'
  ```







  ![system manager](image/session.png)





  ```bash

  sudo -i


  root# docker ps -a



  root# cd /home/ec2-user/.gitlab-runner/ && ls
  config.toml
  ```



  [![Stargazers repo roster for @neilkuan/cdk-gitlab-runner](https://reporoster.com/stars/neilkuan/cdk-gitlab-runner)](https://github.com/neilkuan/cdk-gitlab-runner/stargazers)


pkgId: d8bf55a162c719182e463b0d4e060c574e590a9314de4a50388ee76db6a001dd
name: python-cdk-gradle-uploader
arch: src
version: 0.0.30
epoch: 0
release: 1
summary: Uploads new Gradle versions to an S3 bucket
url: https://github.com/stefanfreitag/gradle_uploader.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-gradle-uploader-0.0.30-1.src.rpm
checksum_type: sha256
description:
  This CDK construct checks for new releases of the [Gradle](https://gradle.org/) build software.

  The new release will be made available as copy in an S3 bucket. An information about
  the new release can be sent via e-mail or via Slack.

  Internally the construct uses

  * an [S3](https://aws.amazon.com/s3/) bucket for storing the Gradle software
  * a [Lambda](https://aws.amazon.com/lambda/) function and one Lambda layer to

    * check for the latest Gradle release
    * upload if required and notify users via [SNS](https://aws.amazon.com/sns/) and e-Mail or alternatively Slack
  * a [Cloudwatch](https://aws.amazon.com/cloudwatch/) event rule to trigger the Lambda function

  ![Overview](docs/overview.png)





  By default, public access to the S3 bucket is disabled. Only the access from a specific IP address (the one I got from my ISP) is allowed and ensured via [bucket policies](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-policy.html).

  ```javascript
    const bucket = new Bucket(this, "bucket", {
        blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
        encryption: BucketEncryption.S3_MANAGED,
        publicReadAccess: false,
        versioned: false,
        removalPolicy: RemovalPolicy.DESTROY,
      });

      const bucketContentStatement = new PolicyStatement({
        effect: Effect.ALLOW,
        actions: ["s3:GetObject"],
        resources: [bucket.bucketArn + "/*"],
        principals: [new AnyPrincipal()],
      });
      bucketContentStatement.addCondition("IpAddress", {
        "aws:SourceIp": "87.122.220.125/32",
      });

      const bucketStatement: PolicyStatement = new PolicyStatement({
        effect: Effect.ALLOW,
        actions: ["s3:ListBucket", "s3:GetBucketLocation"],
        resources: [bucket.bucketArn],
        principals: [new AnyPrincipal()],
      });
      bucketStatement.addCondition("IpAddress", {
        "aws:SourceIp": "87.122.220.125/32",
      });

      const bucketPolicy = new BucketPolicy(this, "bucketPolicy", {
        bucket: bucket,
      });
  ```



  The Lambda function is written in Python (version 3.8). The execution time is limited to five minutes and the memory consumption to 512 MByte. Additionally the function gets read/ write access to the S3 bucket and has a log retention period is set to one week.

  ```javascript
  const fn = new Function(this, "fnUpload", {
    runtime: Runtime.PYTHON_3_8,
    description: "Download Gradle distribution to S3 bucket",
    handler: "gradleUploader.main",
    code: Code.fromAsset("./lambda/"),
    timeout: Duration.minutes(5),
    memorySize: 512,
    logRetention: RetentionDays.ONE_WEEK,
    layers: [layer],
    environment: {
      BUCKET_NAME: bucket.bucketName,
      TOPIC_ARN: topic.topicArn,
    },
  });

  bucket.grantReadWrite(fn);
  ```

  If Slack is selected as notification channel, then also the `WEBHOOK_URL`
  is part of the `environment`.

  In the additional layer modules like boto3 are included.

  ```javascript
  const layer = new LayerVersion(this, "GradleUploaderLayer", {
    code: Code.fromAsset(path.join(__dirname, "../layer-code")),
    compatibleRuntimes: [Runtime.PYTHON_3_8],
    license: "Apache-2.0",
    description: "A layer containing dependencies for thr Gradle Uploader",
  });
  ```



  Every first of a month the Lambda function `fn` will be triggered automatically. That seems to be a reasonable period for the update check.

  ```javascript
  const target = new LambdaFunction(fn);
  new Rule(this, "ScheduleRule", {
    schedule: Schedule.cron({ minute: "0", hour: "0", day: "1", month: "*" }),
     targets: [target],
  });
  ```



  Whenever the release of a new Gradle version is detected, the stack will sent an e-mail to the list of subscriber using SNS.

  ```javascript
  private addSubscribers(topic: Topic, subscribers:Array<string>) {
      for (var subscriber of subscribers) {
        topic.addSubscription(new EmailSubscription(subscriber));
      }
    }
  ```

  The forwarding of information to a [Slack](https://slack.com/) channel is done from within the Lambda function.



  ```shell
  docker run --rm -v "$PWD":/var/task:ro,delegated   -v /home/stefan/Private/programmieren/aws/cdk/gradle_uploader/layer-code:/opt:ro,delegated  -e AWS_ACCESS_KEY_ID=XXXXXXXXXX -e AWS_SECRET_ACCESS_KEY=XXXXXXXXXX lambci/lambda:python3.8 gradleUploader.main
  ```



  Here is an example how to use the construct:

  ```javascript
  export class GradleUploaderStack extends Stack {
    constructor(scope: Construct, id: string) {
      super(scope, id);
      new GradleUploader(this, 'TestStack', {
        mailProperties: { subscribers: ['<e-mail address>'] },
        slackProperties: {
          webhook:
            'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX',
        },
        whitelist: ['CIDR_1', 'CIDR_2'],
      });
    }
  }

  const app = new App();
  new GradleUploaderStack(app, 'TestApp');
  app.synth();
  ```



  * [AWS Cloud Development Kit](https://github.com/aws/aws-cdk)
  * [Gradle Homepage](https://gradle.org/)
  * [boto3](https://github.com/boto/boto3)
  * [Slack](https://slack.com/)


pkgId: 56b4e7b29e965f327e8c1e0c53561b7794382deb6bd6b7c4862b007b5c759ea7
name: python-cdk-http-pinger
arch: src
version: 0.1.222
epoch: 0
release: 1
summary: HTTP Pinger for AWS CDK
url: https://github.com/pahud/cdk-http-pinger.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-http-pinger-0.1.222-1.src.rpm
checksum_type: sha256
description:
  [![NPM version](https://badge.fury.io/js/cdk-http-pinger.svg)](https://badge.fury.io/js/cdk-http-pinger)
  [![PyPI version](https://badge.fury.io/py/cdk-http-pinger.svg)](https://badge.fury.io/py/cdk-http-pinger)
  ![Release](https://github.com/pahud/cdk-http-pinger/workflows/Release/badge.svg?branch=main)



  HTTP Pinger for AWS CDK



  ```python
  import { Pinger } from 'cdk-http-pinger';

  const app = new App();

  const stack = new Stack(app, 'my-stack');

  const pinger = new Pinger(stack, 'Pinger', { url: 'https://aws.amazon.com' });

  new CfnOutput(stack, 'HttpStatus', { value: pinger.httpStatus });
  new CfnOutput(stack, 'HtmlTitle', { value: pinger.htmlTitle });
  new CfnOutput(stack, 'URL', { value: pinger.url });
  new CfnOutput(stack, 'Body', { value: pinger.body });
  ```


pkgId: 8a7b05ae99939c0af2c05d8799656e2fe0fc7d53f85c6967feeacf9a957ce482
name: python-cdk-hugo-deploy
arch: src
version: 0.0.443
epoch: 0
release: 1
summary: Deploy Hugo static websites to AWS
url: https://github.com/maafk/cdk-hugo-deploy.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-hugo-deploy-0.0.443-1.src.rpm
checksum_type: sha256
description:
  This is an AWS CDK Construct for easily deploying [Hugo](https://gohugo.io/) Static websites to AWS S3 behind SSL/Cloudfront.



  Before deploying, run the `hugo` command in your Hugo project to generate a built site in the `public` directory.



  ```python
  import { App, Stack, StackProps } from 'aws-cdk-lib';
  import { HugoDeploy } from 'cdk-hugo-deploy';

  export class MyStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);

      new HugoDeploy(this, 'HugoDeploy', {
        publicDir: 'path/to/hugo-project/public',
        domainName: 'example.com'  // Domain you already have a hosted zone for
      });
  }
  ```



  ```python
  from constructs import Construct
  from aws_cdk import Stack
  from cdk_hugo_deploy import HugoDeploy

  class MyStack(Stack):
      def __init__(self, scope: Construct, id: str, **kwargs):
          super().__init__(scope, id, **kwargs)

          HugoDeploy(self, "HugoDeploy",
              public_dir="path/to/hugo-project/public",
              domain_name="example.com"
          )
  ```



  Assumes that there is already a Route53 hosted zone for `domainName` that can be [looked up](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_route53.HostedZone.html#static-fromwbrlookupscope-id-query)



  Other constructs for deploying Single Page Applicationis (SPA) such as [CDK-SPA-Deploy](https://github.com/nideveloper/CDK-SPA-Deploy) don't account for how Hugo handles paths that end in `/`.

  This construct includes a [Cloudfront Function](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-functions.html) to [rewrite paths](src/hugoPaths.js) to ensure `/path/to/page/` will request `/path/to/page/index.html` from the S3 Origin.



  Please open an [issue](https://github.com/maafk/cdk-hugo-deploy/issues) with any updates/features you'd like on this


pkgId: 8a593580c7121fb4b4edbc29324c0a258ff2751e4b5d91350068db1a63f8d3df
name: python-cdk-iam-floyd
arch: src
version: 0.507.0
epoch: 0
release: 1
summary: AWS IAM policy statement generator with fluent interface for AWS CDK
url: https://github.com/udondan/iam-floyd
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-iam-floyd-0.507.0-1.src.rpm
checksum_type: sha256
description:
  The code contained in the [lib/generated](https://github.com/udondan/iam-floyd/tree/main/lib/generated) folder is generated from the [AWS documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_actions-resources-contextkeys.html). The class- and function-names and their description therefore are property of AWS.
  AWS and their services are trademarks, registered trademarks or trade dress of AWS in the U.S. and/or other countries.
  This project is not affiliated, funded, or in any way associated with AWS.
  IAM Floyd is licensed under [Apache License 2.0](https://github.com/udondan/iam-floyd/blob/main/LICENSE). Dependencies might be released under different licenses. Especially the bundled packages [regex-parser](https://www.npmjs.com/package/regex-parser) and [common-substrings](https://www.npmjs.com/package/common-substrings) are released under the MIT License.


pkgId: 5a2248b7d9eeae963a1de9e0d4a18ff583d380e4ec2f1239249e1f2b34b75bc6
name: python-cdk-image-pipeline
arch: src
version: 0.5.79
epoch: 0
release: 1
summary: Quickly deploy a complete EC2 Image Builder Image Pipeline using CDK
url: https://github.com/aws-samples/cdk-image-pipeline.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-image-pipeline-0.5.79-1.src.rpm
checksum_type: sha256
description:
  L3 construct that can be used to quickly deploy a complete EC2 Image Builder Image Pipeline.
  This construct creates the required infrastructure for an Image Pipeline:
  * Infrastructure configuration which specifies the infrastructure within which to build and test your EC2 Image Builder image.
  * An instance profile associated with the infrastructure configuration
  * An EC2 Image Builder recipe defines the base image to use as your starting point to create a new image, along with the set of components that you add to customize your image and verify that everything is working as expected.
  * Image Builder uses the AWS Task Orchestrator and Executor (AWSTOE) component management application to orchestrate complex workflows. AWSTOE components are based on YAML documents that define the scripts to customize or test your image. Support for multiple components.
  * Image Builder image pipelines provide an automation framework for creating and maintaining custom AMIs and container images.


pkgId: 363f8057f2954a37edb9abc540532b2a37b88056d243caea8b6e7b384e14b3eb
name: python-cdk-iot-core-certificates
arch: src
version: 1.0.75
epoch: 0
release: 1
summary: cdk-iot-core-certificates
url: https://github.com/polyperception/cdk-iot-core-certificates
rpm_license: MIT
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-iot-core-certificates-1.0.75-1.src.rpm
checksum_type: sha256
description:
  [![Source](https://img.shields.io/badge/Source-GitHub-blue?logo=github)](https://github.com/devops-at-home/cdk-iot-core-certificates)
  [![Release](https://github.com/devops-at-home/cdk-iot-core-certificates/workflows/Release/badge.svg)](https://github.com/devops-at-home/cdk-iot-core-certificates/actions/workflows/release.yml)
  [![GitHub](https://img.shields.io/github/license/devops-at-home/cdk-iot-core-certificates)](https://github.com/devops-at-home/cdk-iot-core-certificates/blob/main/LICENSE)
  [![Docs](https://img.shields.io/badge/awscdk.io-cdk--iot--core--certificates-orange)](https://awscdk.io/packages/cdk-iot-core-certificates@0.0.4/#/)

  [![npm package](https://img.shields.io/npm/v/cdk-iot-core-certificates?color=brightgreen)](https://www.npmjs.com/package/cdk-iot-core-certificates)

  ![Downloads](https://img.shields.io/badge/-DOWNLOADS:-brightgreen?color=gray)
  [![npm downloads](https://img.shields.io/npm/dt/cdk-iot-core-certificates?label=npm&color=blueviolet)](https://www.npmjs.com/package/cdk-iot-core-certificates)

  [AWS CDK](https://aws.amazon.com/cdk/) L3 construct for managing certificates for [AWS IoT Core](https://aws.amazon.com/iot-core/)

  CloudFormation doesn't directly support creation of certificates for AWS IoT Core. This construct provides an easy interface for creating certificates through a [custom CloudFormation resource](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/template-custom-resources.html). The private key is stored in [AWS Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html).



  This package has peer dependencies, which need to be installed along in the expected version.

  For TypeScript/NodeJS, add these to your `dependencies` in `package.json`:

  * cdk-iot-core-certificates



  ```python
  import { ThingWithCert } from 'cdk-iot-core-certificates';

  // Creates new AWS IoT Thing called thingName
  // Saves certs to /devices/thingName/certPem and /devices/thingName/privKey
  // thingName and paramPrefix cannot start with '/'
  const { thingArn, certId, certPem, privKey } = new ThingWithCert(this, 'ThingWithCert', {
      thingName: 'integrationTest',
      saveToParamStore: true,
      paramPrefix: 'devices',
  });

  new CfnOutput(this, 'Output-ThingArn', {
      value: thingArn,
  });

  new CfnOutput(this, 'Output-CertId', {
      value: certId,
  });

  new CfnOutput(this, 'Output-CertPem', {
      value: certPem,
  });

  new CfnOutput(this, 'Output-PrivKey', {
      value: privKey,
  });
  ```


pkgId: 0c888e8465173a77cd4287abec9a372dee156f2d7bd12a6ea5002baf43dbbd92
name: python-cdk-iot-core-certificates-v3
arch: src
version: 0.0.11
epoch: 0
release: 1
summary: CDK Construct for AWS IoT Core certificates and things
url: https://github.com/badmintoncryer/cdk-iot-core-certificates-v3.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-iot-core-certificates-v3-0.0.11-1.src.rpm
checksum_type: sha256
description:
  This is a CDK construct that creates an AWS IoT Core Thing with a certificate and policy using [aws-sdk-js-v3](https://github.com/aws/aws-sdk-js-v3).

  ![elements](./images/iot.png)

  Cloudformation does not support creating a certificate for an IoT Thing, so this construct uses the AWS SDK to create a certificate and attach it to the Thing.

  This construct is a modified version of this excellent [construct (cdk-iot-core-certificate)](https://github.com/devops-at-home/cdk-iot-core-certificates) to work with aws-sdk-js-v3.

  [![View on Construct Hub](https://constructs.dev/badge?package=cdk-iot-core-certificates-v3)](https://constructs.dev/packages/cdk-iot-core-certificates-v3)
  [![Open in Visual Studio Code](https://img.shields.io/static/v1?logo=visualstudiocode&label=&message=Open%20in%20Visual%20Studio%20Code&labelColor=2c2c32&color=007acc&logoColor=007acc)](https://open.vscode.dev/badmintoncryer/cdk-iot-core-certificates-v3)
  [![npm version](https://badge.fury.io/js/cdk-iot-core-certificates-v3.svg)](https://badge.fury.io/js/cdk-iot-core-certificates-v3)
  [![Build Status](https://github.com/badmintoncryer/cdk-iot-core-certificates-v3/actions/workflows/build.yml/badge.svg)](https://github.com/badmintoncryer/cdk-iot-core-certificates-v3/actions/workflows/build.yml)
  [![Release Status](https://github.com/badmintoncryer/cdk-iot-core-certificates-v3/actions/workflows/release.yml/badge.svg)](https://github.com/badmintoncryer/cdk-iot-core-certificates-v3/actions/workflows/release.yml)
  [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
  ![Downloads](https://img.shields.io/badge/-DOWNLOADS:-brightgreen?color=gray)
  ![npm downloads](https://img.shields.io/npm/dt/cdk-iot-core-certificates-v3?label=npm&color=blueviolet)



  ```bash
  npm i cdk-iot-core-certificates-v3
  ```



  ```python
  import * as s3 from 'aws-cdk-lib/aws-s3';
  import { ThingWithCert } from 'cdk-iot-core-certificates-v3';

  declare const saveFileBucket: s3.IBucket;

  const { thingArn, certId, certPem, privKey } = new ThingWithCert(this, 'MyThing', {
    // The name of the thing
    thingName: 'MyThing',
    // Whether to save the certificate and private key to the SSM Parameter Store
    saveToParamStore: true,
    // The prefix to use for the SSM Parameter Store parameters
    paramPrefix: 'test',
    // The bucket to save the certificate and private key to
    // Both files are saved at `{thingName}/{thingName}.private.key` and `{thingName}/{thingName}.cert.pem`
    // If not provided, the certificate and private key will not be saved
    saveFileBucket,
  });
  ```


pkgId: 1fa06ed1627b08cbadcf90ae3ef4036171282029d3b669035efb7c3d2e3996a3
name: python-cdk-keycloak
arch: src
version: 2.9.0
epoch: 0
release: 1
summary: CDK construct library that allows you to create KeyCloak service on AWS in TypeScript or Python
url: https://github.com/aws-samples/cdk-keycloak.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-keycloak-2.9.0-1.src.rpm
checksum_type: sha256
description:
  [![NPM version](https://badge.fury.io/js/cdk-keycloak.svg)](https://badge.fury.io/js/cdk-keycloak)
  [![PyPI version](https://badge.fury.io/py/cdk-keycloak.svg)](https://badge.fury.io/py/cdk-keycloak)
  [![release](https://github.com/aws-samples/cdk-keycloak/actions/workflows/release.yml/badge.svg)](https://github.com/aws-samples/cdk-keycloak/actions/workflows/release.yml)



  CDK construct library that allows you to create [KeyCloak](https://www.keycloak.org/) on AWS in TypeScript or Python

  > **Note**
  >
  > This project has been migrated to CDK v2.
  >
  > CDK v1 compatible version is deprecated now.



  For Keycloak 17+ versions, please specify hostname for the Keycloak server.

  ```python
  import { KeyCloak } from 'cdk-keycloak';

  const app = new cdk.App();

  const env = {
    region: process.env.CDK_DEFAULT_REGION,
    account: process.env.CDK_DEFAULT_ACCOUNT,
  };

  const stack = new cdk.Stack(app, 'keycloak-demo', { env });
  new KeyCloak(stack, 'KeyCloak', {
    hostname: 'keycloak.example.com',
    certificateArn: 'arn:aws:acm:us-east-1:123456789012:certificate/293cf875-ca98-4c2e-a797-e1cf6df2553c',
    keycloakVersion: KeycloakVersion.V22_0_4,
  });
  ```



  Use `keycloakVersion` to specify the version.

  ```python
  new KeyCloak(stack, 'KeyCloak', {
    hostname,
    certificateArn,
    keycloakVersion: KeycloakVersion.V22_0_4,
  });
  ```

  To specify any other verion not defined in the construct, use `KeycloakVersion.of('x.x.x')`. This allows you to specify any new version as soon as it's available. However, as new versions will not always be tested and validated with this construct library, make sure you fully backup and test before you use any new version in the production environment.



  The `KeyCloak` construct provisions the **Amaozn RDS cluster for MySQL** with **2** database instances under the hood, to opt in **Amazon Aurora Serverless**, use `auroraServerless` to opt in Amazon Aurora Serverless cluster. Please note only some regions are supported, check [Supported features in Amazon Aurora by AWS Region and Aurora DB engine](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Concepts.AuroraFeaturesRegionsDBEngines.grids.html) for availability.

  ```python
  // Aurora Serverless v1
  new KeyCloak(stack, 'KeyCloak', {
    hostname,
    certificateArn,
    keycloakVersion,
    auroraServerless: true,
  });

  // Aurora Serverless v2
  new KeyCloak(stack, 'KeyCloak', {
    hostname,
    certificateArn,
    keycloakVersion,
    auroraServerlessV2: true,
  });
  ```

  Behind the scene, a default RDS cluster for MySQL with 2 database instances will be created.



  To create single RDS instance for your testing or development environment, use `singleDbInstance` to turn on the
  single db instance deployment.

  Plesae note this is not recommended for production environment.

  ```python
  new KeyCloak(stack, 'KeyCloak', {
    hostname,
    certificateArn,
    keycloakVersion,
    singleDbInstance: true,
  });
  ```



  Define `autoScaleTask` for the ecs service task autoscaling. For example:

  ```python
  new KeyCloak(stack, 'KeyCloak', {
    hostname,
    certificateArn,
    keycloakVersion,
    auroraServerlessV2: true,
    nodeCount: 2,
    autoScaleTask: {
      min: 2,
      max: 10,
      targetCpuUtilization: 60,
    },
  });
  ```



  Define `taskCpu` or `taskMemory` for overriding the defaults for the ecs service task.
  Could be useful for development environments. For example:

  ```python
  new KeyCloak(stack, 'KeyCloak', {
    hostname,
    certificateArn,
    keycloakVersion,
    nodeCount: 1,
    taskCpu: 512,
    taskMemory: 2048,
  });
  ```



  You can deploy the workload in the existing Vpc and subnets. The `publicSubnets` are for the ALB, `privateSubnets` for the keycloak container tasks and `databaseSubnets` for the database.

  The best practice is to specify isolated subnets for `databaseSubnets`, however, in some cases might have no existing isolates subnets then the private subnets are also acceptable.

  Consider the sample below:

  ```python
  new KeyCloak(stack, 'KeyCloak', {
    hostname: 'keycloak.example.com',
    keycloakVersion: KeycloakVersion.V22_0_4,
    certificateArn: 'arn:aws:acm:us-east-1:123456789012:certificate/293cf875-ca98-4c2e-a797-e1cf6df2553c',
    vpc: ec2.Vpc.fromLookup(stack, 'Vpc', { vpcId: 'vpc-0417e46d' }),
    publicSubnets: {
      subnets: [
        ec2.Subnet.fromSubnetId(stack, 'pub-1a', 'subnet-5bbe7b32'),
        ec2.Subnet.fromSubnetId(stack, 'pub-1b', 'subnet-0428367c'),
        ec2.Subnet.fromSubnetId(stack, 'pub-1c', 'subnet-1586a75f'),
      ],
    },
    privateSubnets: {
      subnets: [
        ec2.Subnet.fromSubnetId(stack, 'priv-1a', 'subnet-0e9460dbcfc4cf6ee'),
        ec2.Subnet.fromSubnetId(stack, 'priv-1b', 'subnet-0562f666bdf5c29af'),
        ec2.Subnet.fromSubnetId(stack, 'priv-1c', 'subnet-00ab15c0022872f06'),
      ],
    },
    databaseSubnets: {
      subnets: [
        ec2.Subnet.fromSubnetId(stack, 'db-1a', 'subnet-0e9460dbcfc4cf6ee'),
        ec2.Subnet.fromSubnetId(stack, 'db-1b', 'subnet-0562f666bdf5c29af'),
        ec2.Subnet.fromSubnetId(stack, 'db-1c', 'subnet-00ab15c0022872f06'),
      ],
    },
  });
  ```



  This library support AWS China regions `cn-north-1` and `cn-northwest-1` and will auto select local docker image mirror to accelerate the image pulling. You don't have to do anything.



  See [CONTRIBUTING](CONTRIBUTING.md#security-issue-notifications) for more information.



  This project is licensed under the Apache-2.0 License.


pkgId: 23dd9ea11c9520f0010aa7013d93d16787a28d79119d9b9fffc824733d336864
name: python-cdk-klayers
arch: src
version: 0.3.0
epoch: 0
release: 1
summary: please add a summary manually as the author left a blank one
url: https://pypi.org/project/cdk-klayers/
rpm_license: None
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-klayers-0.3.0-1.src.rpm
checksum_type: sha256
description:
  [![Python 3.10](https://img.shields.io/badge/python-3.10-green?style=for-the-badge)](https://www.python.org/downloads/release/python-3100/)
  [![Python 3.11](https://img.shields.io/badge/python-3.11-green?style=for-the-badge)](https://www.python.org/downloads/release/python-3110/)
  [![Python 3.12](https://img.shields.io/badge/python-3.12-green?style=for-the-badge)](https://www.python.org/downloads/release/python-3120/)  [![Code style: black](https://img.shields.io/badge/code%20style-black-000000?style=for-the-badge)](https://github.com/psf/black)



  Use [Klayers](https://github.com/keithrozario/Klayers) within your CDK Stacks.



      pip install cdk-klayers



  Simply use the Klayers Class within your CDK `Stack`. You will need to specify a runtime and region for it to work.

  ```python

  from cdk_klayers import Klayers

  class MockStack(Stack):

      def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
          super().__init__(scope, construct_id, **kwargs)

          runtime = aws_lambda.Runtime.PYTHON_3_12

          
          klayers = Klayers(
              self,
              python_version = runtime
              region = "ap-southeast-1"
          )

          
          requests_layer = klayers.layer_version(self, "requests")

          lambda_function = aws_lambda.Function(
              self, 'HelloHandler',
              runtime=runtime,
              layers=[requests_layer],
              code=aws_lambda.Code.from_asset('lambda'),
              hand

  ```



  This example shows a fully working CDK stack that deploys a single lambda function with 2 layers from Klayers. The region of the stack was inferred from the CDK `Environment`.

  ```python

  from aws_cdk import aws_lambda
  from aws_cdk import App, Environment, Stack
  from aws_cdk import Aws
  from constructs import Construct

  from cdk_klayers import Klayers

  class MockStack(Stack):

      def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
          super().__init__(scope, construct_id, **kwargs)

          runtime = aws_lambda.Runtime.PYTHON_3_12

          
          klayers = Klayers(
              self,
              python_version = runtime
          )

          
          requests_layer = klayers.layer_version(self, "requests")
          idna_layer = klayers.layer_version(self, "idna", layer_version="2")

          lambda_function = aws_lambda.Function(
              self, 'HelloHandler',
              runtime=runtime,
              layers=[requests_layer, idna_layer],
              code=aws_lambda.Code.from_asset('lambda'),
              handler='hello.handler'
          )


  app = App()
  env = Environment(region="us-east-1")
  mock_stack =MockStack(app, "test", env=env)
  ```



  We're still in beta, this might change. Please raise an issue if you have any feedback.


pkgId: af9ce659da212a48b3bd6e9f52b77cf0dfd3275838f34d77d2feece3110af2df
name: python-cdk-kubesphere
arch: src
version: 2.0.315
epoch: 0
release: 1
summary: CDK construct library to deploy KubeSphere on AWS
url: https://github.com/pahud/cdk-kubesphere.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-kubesphere-2.0.315-1.src.rpm
checksum_type: sha256
description:
  [![NPM version](https://badge.fury.io/js/cdk-kubesphere.svg)](https://badge.fury.io/js/cdk-kubesphere)
  [![PyPI version](https://badge.fury.io/py/cdk-kubesphere.svg)](https://badge.fury.io/py/cdk-kubesphere)
  ![Release](https://github.com/pahud/cdk-kubesphere/workflows/Release/badge.svg)



  **cdk-kubesphere** is a CDK construct library that allows you to create [KubeSphere](https://kubesphere.io/) on AWS with CDK in TypeScript, JavaScript or Python.



  ```python
  import { KubeSphere } from 'cdk-kubesphere';

  const app = new cdk.App();

  const stack = new cdk.Stack(app, 'cdk-kubesphere-demo');

  // deploy a default KubeSphere service on a new Amazon EKS cluster
  new KubeSphere(stack, 'KubeSphere');
  ```

  Behind the scene, the `KubeSphere` construct creates a default Amazon EKS cluster and `KubeSphere` serivce with helm chart([ks-installer](https://github.com/kubesphere/ks-installer)) on it.

  <details>
  <summary>View helm command</summary>
  AWS CDK will helm install the `ks-installer`  on the cluster:

  ```sh
  helm install ks-installer \
  --repo https://charts.kubesphere.io/test \
  --namespace=kubesphere-system \
  --generate-name \
  --create-namespace
  ```

  </details>



  Use `appStore` to enable the [KubeSphere App Store](https://kubesphere.io/docs/pluggable-components/app-store/) support.

  ```python
  new KubeSphere(stack, 'KubeSphere', {
    appStore: true,
  });
  ```

  <details>
  <summary>View helm command</summary>
  AWS CDK will helm install the `ks-installer`  on the cluster:

  ```sh
  helm install ks-installer \
  --set openpitrix.enabled=true \
  --repo https://charts.kubesphere.io/test \
  --namespace=kubesphere-system \
  --generate-name \
  --create-namespace
  ```

  </details>



  You are allowed to deploy `KubeSphere` in any existing Amazon EKS cluster.

  ```python
  const cluster = eks.Cluster.fromClusterAttributes(this, 'MyCluster', {
    clusterName: 'my-cluster-name',
    kubectlRoleArn: 'arn:aws:iam::1111111:role/iam-role-that-has-masters-access',
  });

  // deploy a default KubeSphere service on the existing Amazon EKS cluster
  new KubeSphere(stack, 'KubeSphere', { cluster });
  ```

  See [Using existing clusters](https://github.com/aws/aws-cdk/tree/master/packages/%40aws-cdk/aws-eks#using-existing-clusters) to learn how to import existing cluster in AWS CDK.



  Run the following command to create a `port-forward` from localhost:8888 to `ks-console:80`

  ```sh
  kubectl -n kubesphere-system port-forward service/ks-console 8888:80
  ```

  Open `http://localhost:8888` and enter the default username/password(`admin/P@88w0rd`) to enter the admin console.


pkgId: 9ae74fe31d1b7c50081d05f58a2f6e1c7e476aa8370da5cf34bb6fa68ac5834d
name: python-cdk-lambda-bash
arch: src
version: 2.0.327
epoch: 0
release: 1
summary: Deploy Bash Lambda Functions with AWS CDK
url: https://github.com/pahud/cdk-lambda-bash.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-lambda-bash-2.0.327-1.src.rpm
checksum_type: sha256
description:
  [![NPM version](https://badge.fury.io/js/cdk-lambda-bash.svg)](https://badge.fury.io/js/cdk-lambda-bash)
  [![PyPI version](https://badge.fury.io/py/cdk-lambda-bash.svg)](https://badge.fury.io/py/cdk-lambda-bash)
  [![Release](https://github.com/pahud/cdk-lambda-bash/actions/workflows/release.yml/badge.svg)](https://github.com/pahud/cdk-lambda-bash/actions/workflows/release.yml)



  Deploy Bash Lambda Functions with AWS CDK



  AWS Lambda has the [docker container image support](https://aws.amazon.com/tw/blogs/aws/new-for-aws-lambda-container-image-support/) since AWS re:Invent 2020 which allows you to run your Lambda code in a custom container image. Inspired by [nikovirtala/cdk-eks-experiment](https://github.com/nikovirtala/cdk-eks-experiment/), `cdk-lambda-bash` allows you to specify a local shell script and bundle it up as a custom resource in your cdk stack. On cdk deployment, your shell script will be executed in a Lambda container environment.



  At this moment, we are offering `BashExecFunction` construct class which is a high-level abstraction of `lambda.Function`. By defining the `script` property which poins to your local shell script, on `cdk deploy`, this script will be bundled into a custom docker image and published as a `lambda.DockerImageFunction`.

  If you `fn.run()`, a custom resource will be created and the `lambda.DockerImageFunction` will be executed on deployment.



  Use the npm dist tag to opt in CDKv1 or CDKv2:

  ```sh
  // for CDKv2
  npm install cdk-lambda-bash
  or
  npm install cdk-lambda-bash@latest

  // for CDKv1
  npm install cdk-lambda-bash@cdkv1
  ```



  ```python
  const app = new cdk.App();

  const stack = new cdk.Stack(app, 'my-stack');

  // bundle your Lambda function to execute the local demo.sh in container
  const fn = new BashExecFunction(stack, 'Demo', {
    script: path.join(__dirname, '../demo.sh'),
  })

  // run it as custom resource on deployment
  fn.run();
  ```



  By default, if you update your shell script or Dockerfile and re-deploy your CDK application, the `BashExecFunction`
  will not be re-executed. Use `runOnUpdate` to enable the re-execution on update.

  ```python
  fn.run({ runOnUpdate: true });
  ```



  In some cases, you may customize your own `Dockerfile`, for instances:

  1. You need extra tools or utilities such as `kubectl` or `helm`
  2. You need build from your own base image

  In these cases, create a custom `Dockerfile` as below and add extra utilities i.e. `kubectl`:

  <details><summary>click and view custom Dockerfile sample</summary>

  ```bash
  FROM public.ecr.aws/lambda/provided:al2

  RUN yum install -y unzip jq


  RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" && \
    unzip awscliv2.zip && \
    ./aws/install


  RUN curl -o kubectl https://amazon-eks.s3.us-west-2.amazonaws.com/1.19.6/2021-01-05/bin/linux/amd64/kubectl && \
    chmod +x kubectl && \
    mv kubectl /usr/local/bin/kubectl

  COPY bootstrap /var/runtime/bootstrap
  COPY function.sh /var/task/function.sh
  COPY main.sh /var/task/main.sh
  RUN chmod +x /var/runtime/bootstrap /var/task/function.sh /var/task/main.sh

  WORKDIR /var/task
  CMD [ "function.sh.handler" ]
  ```

  </details>

  Specify your own `Dockerfile` with the `dockerfile` property.

  ```python
  new BashExecFunction(stack, 'Demo', {
    script: path.join(__dirname, '../demo.sh'),
    dockerfile: path.join(__dirname, '../Dockerfile'),
  });
  ```



  In the user script(e.g. `demo.sh`), you are allowed to determine the event type and act accordingly.

  For example

  ```python

  const installArgoCD = new BashExecFunction(...)

  installArgoCD.run({runOnUpdate: true});
  ```

  When you run this sample, `demo.sh` will receive `onCreate` event and you can run your custom logic to "install ArgoCD" like `kubectl apply -f URL`. However, if you comment it off and deploy again:

  ```python
  const installArgoCD = new BashExecFunction(...)

  //installArgoCD.run({runOnUpdate: true});
  ```

  Under the hood, `demo.sh` will receive `onDelete` event and you can run your custom logic to "uninstall ArgoCD"
  like `kubectl delete -f URL`.

  Check the full sample code below:

  <details><summary>Click and view the sample code</summary>

  ```sh



  function onCreate() {
    echo "running kubectl apply -f ..."
  }

  function onUpdate() {
    echo "do nothing on update"
  }

  function onDelete() {
    echo "running kubectl delete -f ..."
  }

  function getRequestType() {
    echo $1 | jq -r .RequestType
  }

  function conditionalExec() {
    requestType=$(getRequestType $EVENT_DATA)

    
    case $requestType in
      'Create') onCreate $1 ;;
      'Update') onUpdate $1 ;;
      'Delete') onDelete $1 ;;
    esac
  }

  echo "Hello cdk lambda bash!!"

  conditionalExec

  exit 0
  ```

  </details>



  See this [tweet](https://twitter.com/pahudnet/status/1370301964836241408)

  ![](https://pbs.twimg.com/media/EwRGRxnUcAQBng-?format=jpg&name=4096x4096)

  ![](https://pbs.twimg.com/media/EwRKGfsUYAENjP-?format=jpg&name=4096x4096)


pkgId: 6969c9f0d2e108a02cedea367e1c852133577b41c825405c4465c6d6498d438f
name: python-cdk-lambda-layer-curl
arch: src
version: 2.0.838
epoch: 0
release: 1
summary: For lambda layer use curl
url: https://github.com/clarencetw/cdk-lambda-layer-curl.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-lambda-layer-curl-2.0.838-1.src.rpm
checksum_type: sha256
description:
  [![NPM version](https://badge.fury.io/js/cdk-lambda-layer-curl.svg)](https://badge.fury.io/js/cdk-lambda-layer-curl)
  [![PyPI version](https://badge.fury.io/py/cdk-lambda-layer-curl.svg)](https://badge.fury.io/py/cdk-lambda-layer-curl)
  ![Release](https://github.com/clarencetw/cdk-lambda-layer-curl/workflows/release/badge.svg)
  [![Gitpod Ready-to-Code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/clarencetw/cdk-lambda-layer-curl)

  Usage:

  ```python
  // CurlLayer bundles the curl in a lambda layer
  import { CurlLayer } from 'cdk-lambda-layer-curl';

  declare const fn: lambda.Function;
  fn.addLayers(new CurlLayer(this, 'CurlLayer'));
  ```

  ```python
  import { CurlLayer } from 'cdk-lambda-layer-curl'
  import * as lambda from 'aws-cdk-lib/aws-lambda'

  new lambda.Function(this, 'MyLambda', {
    code: lambda.Code.fromAsset(path.join(__dirname, 'my-lambda-handler')),
    handler: 'index.main',
    runtime: lambda.Runtime.PYTHON_3_9,
    layers: [new CurlLayer(this, 'CurlLayer')]
  });
  ```


pkgId: ff9ffe19a4e93339f45013b6849157e86ea2692b111c0d988a1357ababaf50d0
name: python-cdk-lambda-powertools-python-layer
arch: src
version: 2.1.0
epoch: 0
release: 1
summary: A lambda layer for AWS Powertools for python
url: https://github.com/aws-samples/cdk-lambda-powertools-python-layer.git
rpm_license: MIT-0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-lambda-powertools-python-layer-2.1.0-1.src.rpm
checksum_type: sha256
description:
  This is a custom construct that will create AWS Lambda Layer with AWS Powertools for Python library. There are different
  ways how to create a layer and when working with CDK you need to install the library, create a zip file and wire it
  correctly. With this construct you don't have to care about packaging and dependency management, just create a construct
  and add it to your function. The construct is an extension of the
  existing [`LayerVersion`](https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-lambda.LayerVersion.html) construct
  from the CDK library, so you have access to all fields and methods.

  See the [API](API.md) for details.

  ```python
  import { LambdaPowertoolsLayer } from 'cdk-lambda-powertools-python-layer';

  const powertoolsLayer = new LambdaPowertoolsLayer(this, 'TestLayer');
  ```

  Python

  ```python
  from cdk_lambda_powertools_python_layer import LambdaPowertoolsLayer

  powertoolsLayer = LambdaPowertoolsLayer(self, 'PowertoolsLayer')
  ```

  The layer will be created during the CDK `synth` step and thus requires Docker.



  TypeSript/JavaScript:

  ```shell
  npm i cdk-lambda-powertools-python-layer
  ```

  Python:

  ```shell
  pip install cdk-lambda-powertools-python-layer
  ```





  A single line will create a layer with powertools for python:

  ```python
  from cdk_lambda_powertools_python_layer import LambdaPowertoolsLayer

  powertoolsLayer = LambdaPowertoolsLayer(self, 'PowertoolsLayer')
  ```

  You can then add the layer to your funciton:

  ```python
  from aws_cdk import aws_lambda

  aws_lambda.Function(self, 'LambdaFunction',
                              code=aws_lambda.Code.from_asset('function'),
                              handler='app.handler',
                              runtime=aws_lambda.Runtime.PYTHON_3_9,
                              layers=[powertoolsLayer])
  ```

  You can specify the powertools version by passing the optional `version` paramter, otherwise the construct will take the
  latest version from pypi repository.

  ```python
  LambdaPowertoolsLayer(self, 'PowertoolsLayer', version='1.24.0')
  ```

  Additionally, powertools have extras depenedncies such as
  Pydantic, [documented here](https://awslabs.github.io/aws-lambda-powertools-python/latest/#lambda-layer). This is not
  included by default, and you have to set this option in the construct definition if you need it:

  ```python
  LambdaPowertoolsLayer(self, 'PowertoolsLayer', include_extras=True)
  ```

  Full example:

  ```python
  from aws_cdk import Stack, aws_lambda
  from cdk_lambda_powertools_python_layer import LambdaPowertoolsLayer
  from constructs import Construct


  class LayerTestStack(Stack):

      def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
          super().__init__(scope, construct_id, **kwargs)

          powertoolsLayer = LambdaPowertoolsLayer(
              self, 'PowertoolsLayer', include_extras=True, version='1.24.0')

          aws_lambda.Function(self, 'LambdaFunction',
                              code=aws_lambda.Code.from_asset('function'),
                              handler='app.handler',
                              runtime=aws_lambda.Runtime.PYTHON_3_9,
                              layers=[powertoolsLayer])

  ```



  Full example for TypeScript:

  ```python
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { LambdaPowertoolsLayer } from 'cdk-lambda-powertools-python-layer';
  import { Code, Function, Runtime } from 'aws-cdk-lib/aws-lambda';
  import * as path from 'path';

  export class CdkPowertoolsExampleStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);

      const powertoolsLayer = new LambdaPowertoolsLayer(this, 'TestLayer', {
        version: '1.22.0',
        includeExtras: true
      });

      new Function(this, 'LambdaFunction', {
        code: Code.fromAsset(path.join('./function')),
        handler: 'app.handler',
        runtime: Runtime.PYTHON_3_9,
        layers: [powertoolsLayer],
      });
    }
  }
  ```


pkgId: a5f5d60f2ba4611af496f9f949cc7ac8e42e45524a13813924e2c778540df845
name: python-cdk-lambda-subminute
arch: src
version: 2.0.500
epoch: 0
release: 1
url: https://github.com/HsiehShuJeng/cdk-lambda-subminute.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-lambda-subminute-2.0.500-1.src.rpm
checksum_type: sha256
summary:
  A construct for deploying a Lambda function that can be invoked every time unit less than one minute.

description:
  [![License](https://img.shields.io/badge/License-Apache%202.0-green)](https://opensource.org/licenses/Apache-2.0) [![Release](https://github.com/HsiehShuJeng/cdk-lambda-subminute/workflows/Release/badge.svg)](https://github.com/HsiehShuJeng/cdk-lambda-subminute/actions/workflows/release.yml) [![npm downloads](https://img.shields.io/npm/dt/cdk-lambda-subminute?label=npm%20downloads&style=plastic)](https://img.shields.io/npm/dt/cdk-lambda-subminute?label=npm%20downloads&style=plastic) [![pypi downloads](https://img.shields.io/pypi/dm/cdk-lambda-subminute?label=pypi%20downloads&style=plastic)](https://img.shields.io/pypi/dm/cdk-lambda-subminute?label=pypi%20downloads&style=plastic) [![NuGet downloads](https://img.shields.io/nuget/dt/Lambda.Subminute?label=NuGet%20downloads&style=plastic)](https://img.shields.io/nuget/dt/Lambda.Subminute?label=NuGet%20downloads&style=plastic) [![repo languages](https://img.shields.io/github/languages/count/HsiehShuJeng/cdk-lambda-subminute?style=plastic)](https://img.shields.io/github/languages/count/HsiehShuJeng/cdk-lambda-subminute?style=plastic)

  | npm (JS/TS) | PyPI (Python) | Maven (Java) | Go | NuGet |
  | --- | --- | --- | --- | --- |
  | [Link](https://www.npmjs.com/package/cdk-lambda-subminute) | [Link](https://pypi.org/project/cdk_lambda_subminute/) | [Link](https://search.maven.org/artifact/io.github.hsiehshujeng/cdk-lambda-subminute) | [Link](https://github.com/HsiehShuJeng/cdk-lambda-subminute-go) | [Link](https://www.nuget.org/packages/Lambda.Subminute/) |

  This construct creates a state machine that can invoke a Lambda function per time unit which can be less than one minute, such as invoking every 10 seconds. You only need to craft a Lambda function and then assign it as an argument into the construct. An example is included.



  <p align="center"><img src="https://raw.githubusercontent.com/HsiehShuJeng/cdk-lambda-subminute/main/images/cdk_lambda_subminute.png"/></p>



  This construct library is reffered to thie AWS Architecture blog post, [*A serverless solution for invoking AWS Lambda at a sub-minute frequency*](https://aws.amazon.com/tw/blogs/architecture/a-serverless-solution-for-invoking-aws-lambda-at-a-sub-minute-frequency/), written by **Emanuele Menga**. I made it as a constrcut library where you only need to care about a target Lambda function, how frequent and how long you want to execute.





  You could also refer to [here](https://github.com/HsiehShuJeng/cdk-lambda-subminute/tree/main/src/demo/typescript).

  ```bash
  $ cdk --init language typescript
  $ yarn add cdk-lambda-subminute
  ```

  ```python
  class TypescriptStack extends cdk.Stack {
    constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
      super(scope, id, props);

      const targetLabmda = new Function(this, 'targetFunction', {
        code: Code.fromInline('exports.handler = function(event, ctx, cb) { return cb(null, "hi"); })'), // It's just a simple function for demonstration purpose only.
        functionName: 'testTargetFunction',
        runtime: Runtime.NODEJS_18_X,
        handler: 'index.handler',
      });
      const cronJobExample = 'cron(50/1 15-17 ? * SUN-SAT *)';
      const subminuteMaster = new LambdaSubminute(this, 'LambdaSubminute', { targetFunction: targetLabmda, cronjobExpression: cronJobExample });

      new cdk.CfnOutput(this, 'OStateMachineArn', { value: subminuteMaster.stateMachineArn });
      new cdk.CfnOutput(this, 'OIteratorFunctionArn', { value: subminuteMaster.iteratorFunction.functionArn });
    }
  }

  const app = new cdk.App();
  new TypescriptStack(app, 'TypescriptStack', {
  });
  ```



  You could also refer to [here](https://github.com/HsiehShuJeng/cdk-lambda-subminute/tree/main/src/demo/python).

  ```bash

  $ python -m ensurepip --upgrade
  $ python -m pip install --upgrade pip
  $ python -m pip install --upgrade virtualenv

  $ cdk init --language python

  $ source .venv/bin/activate
  $ cat <<EOL > requirements.txt
  aws-cdk.core
  aws-cdk.aws-lambda
  cdk-lambda-subminute
  EOL
  $ python -m pip install -r requirements.txt
  ```

  ```python
  from aws_cdk import core as cdk
  from aws_cdk.aws_lambda import Code, Function, Runtime
  from cdk_lambda_subminute import LambdaSubminute

  class PythonStack(cdk.Stack):
      def __init__(self, scope: cdk.Construct, construct_id: str, **kwargs) -> None:
          super().__init__(scope, construct_id, **kwargs)

          target_lambda = Function(
              self, "targetFunction",
              code=Code.from_inline(
                  "exports.handler = function(event, ctx, cb) { return cb(null, \"hi\"); })"),
              function_name="testTargetFunction",
              runtime=Runtime.NODEJS_18_X,
              handler="index.handler"
          )
          cron_job_example = "cron(10/1 4-5 ? * SUN-SAT *)"
          subminute_master = LambdaSubminute(
              self, "LambdaSubminute",
              target_function=target_lambda,
              cronjob_expression=cron_job_example,
              frequency=7,
              interval_time=8)

          cdk.CfnOutput(self, "OStateMachineArn",
                        value=subminute_master.state_machine_arn)
          cdk.CfnOutput(self, "OIteratorFunctionArn",
                        value=subminute_master.iterator_function.function_arn)
  ```

  ```bash
  $ deactivate
  ```



  You could also refer to [here](https://github.com/HsiehShuJeng/cdk-lambda-subminute/tree/main/src/demo/java).

  ```bash
  $ cdk init --language java
  $ mvn package
  ```

  ```xml
  .
  .
  <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <cdk.version>2.149.0</cdk.version>
        <constrcut.verion>2.0.442</constrcut.verion>
        <junit.version>5.7.1</junit.version>
  </properties>
   .
   .
   <dependencies>
       <!-- AWS Cloud Development Kit -->
        <dependency>
              <groupId>software.amazon.awscdk</groupId>
              <artifactId>core</artifactId>
              <version>${cdk.version}</version>
        </dependency>
        <dependency>
              <groupId>software.amazon.awscdk</groupId>
              <artifactId>lambda</artifactId>
              <version>${cdk.version}</version>
        </dependency>
        <dependency>
              <groupId>io.github.hsiehshujeng</groupId>
              <artifactId>cdk-lambda-subminute</artifactId>
              <version>${constrcut.verion}</version>
        </dependency>
       .
       .
       .
   </dependencies>
  ```

  ```java
  package com.myorg;

  import software.amazon.awscdk.core.CfnOutput;
  import software.amazon.awscdk.core.CfnOutputProps;
  import software.amazon.awscdk.core.Construct;
  import software.amazon.awscdk.core.Stack;
  import software.amazon.awscdk.core.StackProps;
  import software.amazon.awscdk.services.lambda.Code;
  import software.amazon.awscdk.services.lambda.Function;
  import software.amazon.awscdk.services.lambda.FunctionProps;
  import software.amazon.awscdk.services.lambda.Runtime;
  import io.github.hsiehshujeng.cdk.lambda.subminute.LambdaSubminute;
  import io.github.hsiehshujeng.cdk.lambda.subminute.LambdaSubminuteProps;

  public class JavaStack extends Stack {
      public JavaStack(final Construct scope, final String id) {
          this(scope, id, null);
      }

      public JavaStack(final Construct scope, final String id, final StackProps props) {
          super(scope, id, props);

          Function targetLambda = new Function(this, "targetFunction",
            FunctionProps.builder()
                .code(Code.fromInline("exports.handler = function(event, ctx, cb) { return cb(null, \"hi\"); })"))
                .functionName("estTargetFunction")
                .runtime(Runtime.NODEJS_18_X)
                .handler("index.handler")
                .build());
          String cronJobExample = "cron(50/1 4-5 ? * SUN-SAT *)";
          LambdaSubminute subminuteMaster = new LambdaSubminute(this, "LambdaSubminute", LambdaSubminuteProps.builder()
                .targetFunction(targetLambda)
                .cronjobExpression(cronJobExample)
                .frequency(6)
                .intervalTime(9)
                .build());

          new CfnOutput(this, "OStateMachineArn",
                  CfnOutputProps.builder()
                    .value(subminuteMaster.getStateMachineArn())
                    .build());
          new CfnOutput(this, "OIteratorFunctionArn",
                  CfnOutputProps.builder()
                    .value(subminuteMaster.getIteratorFunction().getFunctionName())
                    .build());
      }
  }

  ```



  You could also refer to [here](https://github.com/HsiehShuJeng/cdk-lambda-subminute/tree/main/src/demo/csharp).

  ```bash
  $ cdk init --language csharp
  $ dotnet add src/Csharp package Amazon.CDK.AWS.Lambda
  $ dotnet add src/Csharp package Lambda.Subminute --version 2.0.442
  ```

  ```cs
  using Amazon.CDK;
  using Amazon.CDK.AWS.Lambda;
  using ScottHsieh.Cdk;

  namespace Csharp
  {
      public class CsharpStack : Stack
      {
          internal CsharpStack(Construct scope, string id, IStackProps props = null) : base(scope, id, props)
          {
              var targetLambda = new Function(this, "targetFunction", new FunctionProps
              {
                  Code = Code.FromInline("exports.handler = function(event, ctx, cb) { return cb(null, \"hi\"); })"),
                  FunctionName = "testTargetFunction",
                  Runtime = Runtime.NODEJS_18_X,
                  Handler = "index.handler"
              });
              string cronJobExample = "cron(50/1 6-7 ? * SUN-SAT *)";
              var subminuteMaster = new LambdaSubminute(this, "LambdaSubminute", new LambdaSubminuteProps
              {
                  TargetFunction = targetLambda,
                  CronjobExpression = cronJobExample,
                  Frequency = 10,
                  IntervalTime = 6,
              });

              new CfnOutput(this, "OStateMachineArn", new CfnOutputProps
              {
                  Value = subminuteMaster.StateMachineArn
              });
              new CfnOutput(this, "OIteratorFunctionArn", new CfnOutputProps
              {
                  Value = subminuteMaster.IteratorFunction.FunctionArn
              });
          }
      }
  }
  ```



  ```bash

  cdk init app -l go

  go get github.com/HsiehShuJeng/cdk-lambda-subminute-go/cdklambdasubminute/v2@v2.0.442

  go mod tidy

  go get -u ./...
  ```



  ![image](https://raw.githubusercontent.com/HsiehShuJeng/cdk-lambda-subminute/main/images/statemachine_diagram.png)



  Originally, I utilized `PythonFuncion` in the module of [**@aws-cdk/aws-lambda-python**](https://docs.aws.amazon.com/cdk/api/latest/docs/aws-lambda-python-readme.html) to build the iterator Lambda function. Every thing works fine, including test, on my local machine (MacBook Pro M1), until it comes to the CI in Github Actions, it awlays gave me the following message:

  ```bash

  Bundling did not produce any output. Check that content is written to /asset-output.

        64 |     }));
        65 |
      > 66 |     this.function = new PythonFunction(this, 'Iterator', {
           |                     ^
        67 |       functionName: 'lambda-subminute-iterator',
        68 |       description: 'A function for breaking the limit of 1 minute with the CloudWatch Rules.',
        69 |       logRetention: RetentionDays.THREE_MONTHS,

        at AssetStaging.bundle (node_modules/@aws-cdk/core/lib/asset-staging.ts:484:13)
        at AssetStaging.stageByBundling (node_modules/@aws-cdk/core/lib/asset-staging.ts:328:10)
        at stageThisAsset (node_modules/@aws-cdk/core/lib/asset-staging.ts:194:35)
        at Cache.obtain (node_modules/@aws-cdk/core/lib/private/cache.ts:24:13)
        at new AssetStaging (node_modules/@aws-cdk/core/lib/asset-staging.ts:219:44)
        at new Asset (node_modules/@aws-cdk/aws-s3-assets/lib/asset.ts:127:21)
        at AssetCode.bind (node_modules/@aws-cdk/aws-lambda/lib/code.ts:277:20)
        at new Function (node_modules/@aws-cdk/aws-lambda/lib/function.ts:583:29)
        at new PythonFunction (node_modules/@aws-cdk/aws-lambda-python/lib/function.ts:106:5)
        at new IteratorLambda (src/cdk-lambda-subminute.ts:66:21)
        at new LambdaSubminute (src/cdk-lambda-subminute.ts:25:22)
        at Object.<anonymous>.test (test/integ.test.ts:23:3)
  ```

  I actually have tried many different methods according to the following threads but to no avail.  I'll attempt to test some thoughts or just post the issue onto the CDK Github repo.

  * [Asset Bundling](https://docs.aws.amazon.com/cdk/api/latest/docs/aws-s3-assets-readme.html#asset-bundling)
  * [Change the bundler's /asset-output local volume mount location #8589](https://github.com/aws/aws-cdk/issues/8589)
  * [(aws-lambda-python: PythonFunction): unable to use bundling in BitBucket #14156](https://github.com/aws/aws-cdk/issues/14516)
  * [BundlingDockerImage.cp() needs to be explained more in the README #11914](https://github.com/aws/aws-cdk/issues/11914)


pkgId: 5acb90ba8dafdb0f56b3fca3926a36d5577d9fc0a0d8b3a37f837d27733574af
name: python-cdk-lex-zip-import
arch: src
version: 0.0.90
epoch: 0
release: 1
summary: cdk construct for importing a zipped Lex bot
url: https://github.com/schuettc/cdk-lex-zip-import.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-lex-zip-import-0.0.90-1.src.rpm
checksum_type: sha256
description:
  ![Experimental](https://img.shields.io/badge/experimental-important.svg?style=for-the-badge)

  An AWS Cloud Development Kit (AWS CDK) construct library that allows you to upload and deploy a Zipped Lex Bot. Once imported, this Bot can be managed within the Amazon Lex Console.



  To add to your AWS CDK package.json file:

  ```
  yarn add cdk-lex-zip-import
  ```

  Within your AWS CDK:



  ```python
  const bot = new lexupload.ImportBot(this, 'lexBot', {
    sourceDirectory: './resources/LexBot',
    lexRoleArn: lexRole.roleArn,
  });
  ```

  The `sourceDirecotry` must include a file named `LexBot.zip`. All files in that directory will be uploaded, but only a file named `LexBot.zip` will be imported to Lex as a Bot.

  The `lexRoleArn` refers to the roleArn of an IAM Role. For example:

  ```python
  const lexRole = new iam.Role(this, 'lexRole', {
    assumedBy: new iam.ServicePrincipal('lex.amazonaws.com'),
    inlinePolicies: {
      ['lexPolicy']: new iam.PolicyDocument({
        statements: [
          new iam.PolicyStatement({
            resources: ['*'],
            actions: ['polly:SynthesizeSpeech', 'comprehend:DetectSentiment'],
          }),
        ],
      }),
    },
  });
  ```



  ```python
  bot.addResourcePolicy(resourceArn, policy);
  ```

  `addResourcePolicy` requires two properties: the `resourceArn` of the Lex Bot, and a policy to be applied. This policy will be applied to the alias associated with the Bot.



  ```python
  const resourceArn = `arn:aws:lex:${this.region}:${this.account}:bot-alias/${bot.botId}/${bot.botAliasId}`;
  ```



  ```python
  const policy = {
    Version: '2012-10-17',
    Statement: [
      {
        Sid: 'AllowChimePstnAudioUseBot',
        Effect: 'Allow',
        Principal: { Service: 'voiceconnector.chime.amazonaws.com' },
        Action: 'lex:StartConversation',
        Resource: resourceArn,
        Condition: {
          StringEquals: { 'AWS:SourceAccount': `${this.account}` },
          ArnEquals: {
            'AWS:SourceArn': `arn:aws:voiceconnector:us-east-1:${this.account}:*`,
          },
        },
      },
    ],
  };
  ```



  This is a work in progress.

  Features that are not supported yet:

  * [ ] Non-Draft Versions
  * [ ] Updates to created resources



  See [CONTRIBUTING](CONTRIBUTING.md) for more information.



  This project is licensed under the Apache-2.0 License.


pkgId: fff400ecf31c2537fb379d754f3227e59af683cd92443a515662cbd0f0c11c18
name: python-cdk-monitoring-constructs
arch: src
version: 8.3.1
epoch: 0
release: 1
summary: cdk-monitoring-constructs
url: https://github.com/cdklabs/cdk-monitoring-constructs
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-monitoring-constructs-8.3.1-1.src.rpm
checksum_type: sha256
description:
  [![NPM version](https://badge.fury.io/js/cdk-monitoring-constructs.svg)](https://badge.fury.io/js/cdk-monitoring-constructs)
  [![Maven Central](https://maven-badges.herokuapp.com/maven-central/io.github.cdklabs/cdkmonitoringconstructs/badge.svg)](https://maven-badges.herokuapp.com/maven-central/io.github.cdklabs/cdkmonitoringconstructs)
  [![PyPI version](https://badge.fury.io/py/cdk-monitoring-constructs.svg)](https://badge.fury.io/py/cdk-monitoring-constructs)
  [![NuGet version](https://badge.fury.io/nu/Cdklabs.CdkMonitoringConstructs.svg)](https://badge.fury.io/nu/Cdklabs.CdkMonitoringConstructs)
  [![Gitpod Ready-to-Code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/cdklabs/cdk-monitoring-constructs)
  [![Mergify](https://img.shields.io/endpoint.svg?url=https://gh.mergify.io/badges/cdklabs/cdk-monitoring-constructs&style=flat)](https://mergify.io)

  Easy-to-use CDK constructs for monitoring your AWS infrastructure with [Amazon CloudWatch](https://aws.amazon.com/cloudwatch/).

  * Easily add commonly-used alarms using predefined properties
  * Generate concise CloudWatch dashboards that indicate your alarms
  * Extend the library with your own extensions or custom metrics
  * Consume the library in multiple supported languages



  <details><summary><strong>TypeScript</strong></summary>

  > https://www.npmjs.com/package/cdk-monitoring-constructs

  In your `package.json`:

  ```json
  {
    "dependencies": {
      "cdk-monitoring-constructs": "^7.0.0",

      // peer dependencies of cdk-monitoring-constructs
      "aws-cdk-lib": "^2.112.0",
      "constructs": "^10.0.5"

      // ...your other dependencies...
    }
  }
  ```

  </details><details><summary><strong>Java</strong></summary>

  See https://mvnrepository.com/artifact/io.github.cdklabs/cdkmonitoringconstructs

  </details><details><summary><strong>Python</strong></summary>

  See https://pypi.org/project/cdk-monitoring-constructs/

  </details><details><summary><strong>C#</strong></summary>

  See https://www.nuget.org/packages/Cdklabs.CdkMonitoringConstructs/

  </details>



  You can browse the documentation at https://constructs.dev/packages/cdk-monitoring-constructs/

  | Item | Monitoring | Alarms | Notes |
  | ---- | ---------- | ------ | ----- |
  | AWS API Gateway (REST API) (`.monitorApiGateway()`) | TPS, latency, errors | Latency, error count/rate, low/high TPS | To see metrics, you have to enable Advanced Monitoring |
  | AWS API Gateway V2 (HTTP API) (`.monitorApiGatewayV2HttpApi()`) | TPS, latency, errors | Latency, error count/rate, low/high TPS | To see route level metrics, you have to enable Advanced Monitoring |
  | AWS AppSync (GraphQL API) (`.monitorAppSyncApi()`) | TPS, latency, errors | Latency, error count/rate, low/high TPS | |
  | Amazon Aurora (`.monitorAuroraCluster()`) | Query duration, connections, latency, CPU usage, Serverless Database Capacity | Connections, Serverless Database Capacity and CPU usage | |
  | AWS Billing (`.monitorBilling()`) | AWS account cost | Total cost (anomaly) | [Requires enabling](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/gs_monitor_estimated_charges_with_cloudwatch.html#gs_turning_on_billing_metrics) the **Receive Billing Alerts** option in AWS Console / Billing Preferences |
  | AWS Certificate Manager (`.monitorCertificate()`) | Certificate expiration | Days until expiration | |
  | AWS CloudFront (`.monitorCloudFrontDistribution()`) | TPS, traffic, latency, errors | Error rate, low/high TPS | |
  | AWS CloudWatch Logs (`.monitorLog()`) | Patterns present in the log group | Minimum incoming logs | |
  | AWS CloudWatch Synthetics Canary (`.monitorSyntheticsCanary()`) | Latency, error count/rate | Error count/rate, latency | |
  | AWS CodeBuild (`.monitorCodeBuildProject()`) | Build counts (total, successful, failed), failed rate, duration | Failed build count/rate, duration | |
  | AWS DocumentDB (`.monitorDocumentDbCluster()`) | CPU, throttling, read/write latency, transactions, cursors | CPU | |
  | AWS DynamoDB (`.monitorDynamoTable()`) | Read and write capacity provisioned / used | Consumed capacity, throttling, latency, errors | |
  | AWS DynamoDB Global Secondary Index (`.monitorDynamoTableGlobalSecondaryIndex()`) | Read and write capacity, indexing progress, throttled events | | |
  | AWS EC2 (`.monitorEC2Instances()`) | CPU, disk operations, network | | |
  | AWS EC2 Auto Scaling Groups (`.monitorAutoScalingGroup()`) | Group size, instance status | | |
  | AWS ECS (`.monitorFargateService()`, `.monitorEc2Service()`, `.monitorSimpleFargateService()`, `monitorSimpleEc2Service()`, `.monitorQueueProcessingFargateService()`, `.monitorQueueProcessingEc2Service()`) | System resources and task health | Unhealthy task count, running tasks count, CPU/memory usage, and bytes processed by load balancer (if any) | Use for ecs-patterns load balanced ec2/fargate constructs (NetworkLoadBalancedEc2Service, NetworkLoadBalancedFargateService, ApplicationLoadBalancedEc2Service, ApplicationLoadBalancedFargateService) |
  | AWS ElastiCache (`.monitorElastiCacheCluster()`) | CPU/memory usage, evictions and connections | CPU, memory, items count | |
  | AWS Glue (`.monitorGlueJob()`) | Traffic, job status, memory/CPU usage | Failed/killed task count/rate | |
  | AWS Kinesis Data Analytics (`.monitorKinesisDataAnalytics`) | Up/Downtime, CPU/memory usage, KPU usage, checkpoint metrics, and garbage collection metrics | Downtime, full restart count | |
  | AWS Kinesis Data Stream (`.monitorKinesisDataStream()`) | Put/Get/Incoming Record/s and Throttling | Throttling, throughput, iterator max age | |
  | AWS Kinesis Firehose (`.monitorKinesisFirehose()`) | Number of records, requests, latency, throttling | Throttling | |
  | AWS Lambda (`.monitorLambdaFunction()`) | Latency, errors, iterator max age | Latency, errors, throttles, iterator max age | Optional Lambda Insights metrics (opt-in) support |
  | AWS Load Balancing (`.monitorNetworkLoadBalancer()`, `.monitorFargateApplicationLoadBalancer()`, `.monitorFargateNetworkLoadBalancer()`, `.monitorEc2ApplicationLoadBalancer()`, `.monitorEc2NetworkLoadBalancer()`) | System resources and task health | Unhealthy task count, running tasks count, (for Fargate/Ec2 apps) CPU/memory usage | Use for FargateService or Ec2Service backed by a NetworkLoadBalancer or ApplicationLoadBalancer |
  | AWS OpenSearch/Elasticsearch (`.monitorOpenSearchCluster()`, `.monitorElasticsearchCluster()`) | Indexing and search latency, disk/memory/CPU usage | Indexing and search latency, disk/memory/CPU usage, cluster status, KMS keys | |
  | AWS RDS (`.monitorRdsCluster()`) | Query duration, connections, latency, disk/CPU usage | Connections, disk and CPU usage | |
  | AWS RDS (`.monitorRdsInstance()`) | Query duration, connections, latency, disk/CPU usage | Connections, disk and CPU usage | |
  | AWS Redshift (`.monitorRedshiftCluster()`) | Query duration, connections, latency, disk/CPU usage | Query duration, connections, disk and CPU usage | |
  | AWS S3 Bucket (`.monitorS3Bucket()`) | Bucket size and number of objects | | |
  | AWS SecretsManager (`.monitorSecretsManager()`) | Max secret count, min secret sount, secret count change | Min/max secret count or change in secret count | |
  | AWS SecretsManager Secret (`.monitorSecretsManagerSecret()`) | Days since last rotation | Days since last change or rotation | |
  | AWS SNS Topic (`.monitorSnsTopic()`) | Message count, size, failed notifications | Failed notifications, min/max published messages | |
  | AWS SQS Queue (`.monitorSqsQueue()`, `.monitorSqsQueueWithDlq()`) | Message count, age, size | Message count, age, DLQ incoming messages | |
  | AWS Step Functions (`.monitorStepFunction()`, `.monitorStepFunctionActivity()`, `monitorStepFunctionLambdaIntegration()`, `.monitorStepFunctionServiceIntegration()`) | Execution count and breakdown per state | Duration, failed, failed rate, aborted, throttled, timed out executions | |
  | AWS Web Application Firewall (`.monitorWebApplicationFirewallAclV2()`) | Allowed/blocked requests | Blocked requests count/rate | |
  | FluentBit (`.monitorFluentBit()`) | Num of input records, Output failures & retries, Filter metrics, Storage metrics | | FluentBit needs proper configuration with  metrics enabled: [Official sample configuration](https://github.com/aws-samples/amazon-ecs-firelens-examples/tree/mainline/examples/fluent-bit/send-fb-internal-metrics-to-cw). This function creates MetricFilters to publish all FluentBit metrics. |
  | Custom metrics (`.monitorCustom()`) | Addition of custom metrics into the dashboard (each group is a widget) | | Supports anomaly detection |





  *Important note*: **Please, do NOT import anything from the `/dist/lib` package.** This is unsupported and might break any time.

  1. Create an instance of `MonitoringFacade`, which is the main entrypoint.
  2. Call methods on the facade like `.monitorLambdaFunction()` and chain them together to define your monitors. You can also use methods to add your own widgets, headers of various sizes, and more.

  For examples of monitoring different resources, refer to [the unit tests](https://github.com/cdklabs/cdk-monitoring-constructs/tree/main/test/monitoring).

  ```python
  export interface MonitoringStackProps extends DeploymentStackProps {
    // ...
  }

  // This could be in the same stack as your resources, as a nested stack, or a separate stack as you see fit
  export class MonitoringStack extends DeploymentStack {
    constructor(parent: App, name: string, props: MonitoringStackProps) {
      super(parent, name, props);

      const monitoring = new MonitoringFacade(this, "Monitoring", {
        // Defaults are provided for these, but they can be customized as desired
        metricFactoryDefaults: { ... },
        alarmFactoryDefaults: { ... },
        dashboardFactory: { ... },
      });

      // Monitor your resources
      monitoring
        .addLargeHeader("Storage")
        .monitorDynamoTable({ /* Monitor a DynamoDB table */ })
        .monitorDynamoTable({ /* and a different table */ })
        .monitorLambdaFunction({ /* and a Lambda function */ })
        .monitorCustom({ /* and some arbitrary metrics in CloudWatch */ })
        // ... etc.
    }
  }
  ```



  Alarms should have an action setup, otherwise they are not very useful. Currently, we support notifying an SNS topic.

  ```python
  const onAlarmTopic = new Topic(this, "AlarmTopic");

  const monitoring = new MonitoringFacade(this, "Monitoring", {
    // ...other props
    alarmFactoryDefaults: {
      // ....other props
      action: new SnsAlarmActionStrategy({ onAlarmTopic }),
    },
  });
  ```

  You can override the default topic for any alarm like this:

  ```python
  monitoring
    .monitorSomething(something, {
      addSomeAlarm: {
        Warning: {
          // ...other props
          threshold: 42,
          actionOverride: new SnsAlarmActionStrategy({ onAlarmTopic }),
        }
      }
    });
  ```



  For simply adding some custom metrics, you can use `.monitorCustom()` and specify your own title and metric groups.
  Each metric group will be rendered as a single graph widget, and all widgets will be placed next to each other.
  All the widgets will have the same size, which is chosen based on the number of groups to maximize dashboard space usage.

  Custom metric monitoring can be created for simple metrics, simple metrics with anomaly detection and search metrics.
  The first two also support alarming.

  Below we are listing a couple of examples. Let us assume that there are three existing metric variables: `m1`, `m2`, `m3`.
  They can either be created by hand (`new Metric({...})`) or (preferably) by using `metricFactory` (that can be obtained from facade).
  The advantage of using the shared `metricFactory` is that you do not need to worry about period, etc.

  ```python
  // create metrics manually
  const m1 = new Metric(/* ... */);
  ```

  ```python
  const metricFactory = monitoringFacade.createMetricFactory();

  // create metrics using metric factory
  const m1 = metricFactory.createMetric(/* ... */);
  ```



  In this case, only one metric is supported.
  Multiple metrics cannot be rendered with anomaly detection in a single widget due to a CloudWatch limitation.

  ```python
  monitorCustom({
    title: "Metric with anomaly detection",
    metrics: [
      {
        metric: m1,
        anomalyDetectionStandardDeviationToRender: 3
      }
    ]
  })
  ```

  Adding an alarm:

  ```python
  monitorCustom({
    title: "Metric with anomaly detection and alarm",
    metrics: [
      {
        metric: m1,
        alarmFriendlyName: "MetricWithAnomalyDetectionAlarm",
        anomalyDetectionStandardDeviationToRender: 3,
        addAlarmOnAnomaly: {
          Warning: {
            standardDeviationForAlarm: 4,
            alarmWhenAboveTheBand: true,
            alarmWhenBelowTheBand: true
          }
        }
      }
    ]
  })
  ```



  ```python
  monitorCustom({
    title: "Metric search",
    metrics: [
      {
        searchQuery: "My.Prefix.",
        dimensionsMap: {
          FirstDimension: "FirstDimensionValue",
          // Allow any value for the given dimension (pardon the weird typing to satisfy DimensionsMap)
          SecondDimension: undefined as unknown as string
        }
        statistic: MetricStatistic.SUM,
      }
    ]
  })
  ```

  Search metrics do not support setting an alarm, which is a CloudWatch limitation.



  Route53 has [strict requirements](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/health-checks-types.html) as to which alarms are allowed to be referenced in Health Checks.
  You adjust the metric for an alarm so that it can be used in a Route53 Health Checks as follows:

  ```python
  monitoring
    .monitorSomething(something, {
      addSomeAlarm: {
        Warning: {
          // ...other props
          metricAdjuster: Route53HealthCheckMetricAdjuster.INSTANCE,
        }
      }
    });
  ```

  This will ensure the alarm can be used on a Route53 Health Check or otherwise throw an `Error` indicating why the alarm can't be used.
  In order to easily find your Route53 Health Check alarms later on, you can apply a custom tag to them as follows:

  ```python
  import { CfnHealthCheck } from "aws-cdk-lib/aws-route53";

  monitoring
    .monitorSomething(something, {
      addSomeAlarm: {
        Warning: {
          // ...other props
          customTags: ["route53-health-check"],
          metricAdjuster: Route53HealthCheckMetricAdjuster.INSTANCE,
        }
      }
    });

  const alarms = monitoring.createdAlarmsWithTag("route53-health-check");

  const healthChecks = alarms.map(({ alarm }) => {
    const id = getHealthCheckConstructId(alarm);

    return new CfnHealthCheck(scope, id, {
      healthCheckConfig: {
        // ...other props
        type: "CLOUDWATCH_METRIC",
        alarmIdentifier: {
          name: alarm.alarmName,
          region: alarm.stack.region,
        },
      },
    });
  });
  ```



  If you want even more flexibility, you can create your own segment.

  This is a general procedure on how to do it:

  1. Extend the `Monitoring` class
  2. Override the `widgets()` method (and/or similar ones)
  3. Leverage the metric factory and alarm factory provided by the base class (you can create additional factories, if you will)
  4. Add all alarms to `.addAlarm()` so they are visible to the user and being placed on the alarm summary dashboard

  Both of these monitoring base classes are dashboard segments, so you can add them to your monitoring by calling `.addSegment()` on the `MonitoringFacade`.



  While the dashboard widgets defined in the library are meant to cover most use cases, they might not be what you're looking for.

  To modify the widgets:

  1. Extend the appropriate `Monitoring` class (e.g., `LambdaFunctionMonitoring` for `monitorLambdaFunction`) and override the relevant methods (e.g., `widgets`):

     ```python
     export class MyCustomizedLambdaFunctionMonitoring extends LambdaFunctionMonitoring {
       widgets(): IWidget[] {
         return [
           // Whatever widgets you want instead of what LambdaFunctionMonitoring has
         ];
       }
     }
     ```
  2. Use the facade's `addSegment` method with your custom class:

     ```python
     declare const facade: MonitoringFacade;

     facade.addSegment(new MyCustomizedLambdaFunctionMonitoring(facade, {
       // Props for LambdaFunctionMonitoring
     }));
     ```



  If you want *even* more flexibility, you can take complete control over dashboard generation by leveraging dynamic dashboarding features. This allows you to create an arbitrary number of dashboards while configuring each of them separately. You can do this in three simple steps:

  1. Create a dynamic dashboard factory
  2. Create `IDynamicDashboardSegment` implementations
  3. Add Dynamic Segments to your `MonitoringFacade`



  The below code sample will generate two dashboards with the following names:

  * ExampleDashboards-HostedService
  * ExampleDashboards-Infrastructure

  ```python
  // create the dynamic dashboard factory.
  const factory = new DynamicDashboardFactory(stack, "DynamicDashboards", {
    dashboardNamePrefix: "ExampleDashboards",
    dashboardConfigs: [
      // 'name' is the minimum required configuration
      { name: "HostedService" },
      // below is an example of additional dashboard-specific config options
      {
        name: "Infrastructure",
        range: Duration.hours(3),
        periodOverride: PeriodOverride.AUTO,
        renderingPreference: DashboardRenderingPreference.BITMAP_ONLY
      },
    ],
  });
  ```



  For each construct you want monitored, you will need to create an implementation of an `IDynamicDashboardSegment`. The following is a basic reference implementation as an example:

  ```python
  export enum DashboardTypes {
    HostedService = "HostedService",
    Infrastructure = "Infrastructure",
  }

  class ExampleSegment implements IDynamicDashboardSegment {
    widgetsForDashboard(name: string): IWidget[] {
      // this logic is what's responsible for allowing your dynamic segment to return
      // different widgets for different dashboards
      switch (name) {
        case DashboardTypes.HostedService:
          return [new TextWidget({ markdown: "This shows metrics for your service hosted on AWS Infrastructure" })];
        case DashboardTypes.Infrastructure:
          return [new TextWidget({ markdown: "This shows metrics for the AWS Infrastructure supporting your hosted service" })];
        default:
          throw new Error("Unexpected dashboard name!");
      }
    }
  }
  ```



  When you have instances of an `IDynamicDashboardSegment` to use, they can be added to your dashboard like this:

  ```python
  monitoring.addDynamicSegment(new ExampleSegment());
  ```

  Now, this widget will be added to both dashboards and will show different content depending on the dashboard. Using the above example code, two dashboards will be generated with the following content:

  * Dashboard Name: "ExampleDashboards-HostedService"

    * Content: "This shows metrics for your service hosted on AWS Infrastructure"
  * Dashboard Name: "ExampleDashboards-Infrastructure"

    * Content: "This shows metrics for the AWS Infrastructure supporting your hosted service"



  Facades can be configured for different regions/accounts as a whole:

  ```python
  new MonitoringFacade(stack, "Monitoring", {
    metricFactoryDefaults: {
      // Different region/account than what you're deploying to
      region: "us-west-2",
      account: "01234567890",
    }
  });
  ```

  Or at a more granular level:

  ```python
  monitoring
    .monitorDynamoTable({
      // Table from the same account/region
      table: Table.fromTableName(stack, "ImportedTable", "MyTableName"),
    })
    .monitorDynamoTable({
      // Table from another account/region
      table: Table.fromTableArn(
        stack,
        "XaXrImportedTable",
        "arn:aws:dynamodb:us-west-2:01234567890:table/my-other-table",
      ),
      region: "us-west-2",
      account: "01234567890",
    });
  ```

  The order of precedence of the region/account values is:

  1. The individual metric factory's props (e.g. via the `monitorDynamoTable` props).
  2. The facade's `metricFactoryDefaults` props.
  3. The region/account that the stack is deployed to.

  Note that while this allows for cross-account cross-Region dashboarding, cross-Region alarming is not supported by CloudWatch.



  You can monitor complete CDK construct scopes using an aspect. It will automatically discover all monitorable resources within the scope recursively and add them to your dashboard.

  ```python
  monitoring.monitorScope(stack, {
    // With optional configuration
    lambda: {
      props: {
        addLatencyP50Alarm: {
          Critical: { maxLatency: Duration.seconds(10) },
        },
      },
    },

    // Some resources that aren't dependent on nodes (e.g. general metrics across instances/account) may be included
    // by default, which can be explicitly disabled.
    billing: { enabled: false },
    ec2: { enabled: false },
    elasticCache: { enabled: false },
  });
  ```



  See [CONTRIBUTING](CONTRIBUTING.md) for more information.



  See [SECURITY](SECURITY.md) for more information.



  This project is licensed under the Apache-2.0 License.


pkgId: da022a19539d8ed3b0a4c114a1c9064963289ebda428dc49cc59bb976ea2557a
name: python-cdk-monitoring-constructs
arch: src
version: 9.1.0
epoch: 0
release: 1
summary: cdk-monitoring-constructs
url: https://github.com/cdklabs/cdk-monitoring-constructs
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-monitoring-constructs-9.1.0-1.src.rpm
checksum_type: sha256
description:
  [![NPM version](https://badge.fury.io/js/cdk-monitoring-constructs.svg)](https://badge.fury.io/js/cdk-monitoring-constructs)
  [![Maven Central](https://maven-badges.herokuapp.com/maven-central/io.github.cdklabs/cdkmonitoringconstructs/badge.svg)](https://maven-badges.herokuapp.com/maven-central/io.github.cdklabs/cdkmonitoringconstructs)
  [![PyPI version](https://badge.fury.io/py/cdk-monitoring-constructs.svg)](https://badge.fury.io/py/cdk-monitoring-constructs)
  [![NuGet version](https://badge.fury.io/nu/Cdklabs.CdkMonitoringConstructs.svg)](https://badge.fury.io/nu/Cdklabs.CdkMonitoringConstructs)
  [![Gitpod Ready-to-Code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/cdklabs/cdk-monitoring-constructs)
  [![Mergify](https://img.shields.io/endpoint.svg?url=https://gh.mergify.io/badges/cdklabs/cdk-monitoring-constructs&style=flat)](https://mergify.io)

  Easy-to-use CDK constructs for monitoring your AWS infrastructure with [Amazon CloudWatch](https://aws.amazon.com/cloudwatch/).

  * Easily add commonly-used alarms using predefined properties
  * Generate concise CloudWatch dashboards that indicate your alarms
  * Extend the library with your own extensions or custom metrics
  * Consume the library in multiple supported languages



  <details><summary><strong>TypeScript</strong></summary>

  > https://www.npmjs.com/package/cdk-monitoring-constructs

  In your `package.json`:

  ```json
  {
    "dependencies": {
      "cdk-monitoring-constructs": "^9.0.0",

      // peer dependencies of cdk-monitoring-constructs
      "aws-cdk-lib": "^2.160.0",
      "constructs": "^10.0.5"

      // ...your other dependencies...
    }
  }
  ```

  </details><details><summary><strong>Java</strong></summary>

  See https://mvnrepository.com/artifact/io.github.cdklabs/cdkmonitoringconstructs

  </details><details><summary><strong>Python</strong></summary>

  See https://pypi.org/project/cdk-monitoring-constructs/

  </details><details><summary><strong>C#</strong></summary>

  See https://www.nuget.org/packages/Cdklabs.CdkMonitoringConstructs/

  </details>



  You can browse the documentation at https://constructs.dev/packages/cdk-monitoring-constructs/

  | Item | Monitoring | Alarms | Notes |
  | ---- | ---------- | ------ | ----- |
  | AWS API Gateway (REST API) (`.monitorApiGateway()`) | TPS, latency, errors | Latency, error count/rate, low/high TPS | To see metrics, you have to enable Advanced Monitoring |
  | AWS API Gateway V2 (HTTP API) (`.monitorApiGatewayV2HttpApi()`) | TPS, latency, errors | Latency, error count/rate, low/high TPS | To see route level metrics, you have to enable Advanced Monitoring |
  | AWS AppSync (GraphQL API) (`.monitorAppSyncApi()`) | TPS, latency, errors | Latency, error count/rate, low/high TPS | |
  | Amazon Aurora (`.monitorAuroraCluster()`) | Query duration, connections, latency, CPU usage, Serverless Database Capacity | Connections, Serverless Database Capacity and CPU usage | |
  | AWS Billing (`.monitorBilling()`) | AWS account cost | Total cost (anomaly) | [Requires enabling](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/gs_monitor_estimated_charges_with_cloudwatch.html#gs_turning_on_billing_metrics) the **Receive Billing Alerts** option in AWS Console / Billing Preferences |
  | AWS Certificate Manager (`.monitorCertificate()`) | Certificate expiration | Days until expiration | |
  | AWS CloudFront (`.monitorCloudFrontDistribution()`) | TPS, traffic, latency, errors | Error rate, low/high TPS | |
  | AWS CloudWatch Logs (`.monitorLog()`) | Patterns present in the log group | Minimum incoming logs | |
  | AWS CloudWatch Synthetics Canary (`.monitorSyntheticsCanary()`) | Latency, error count/rate | Error count/rate, latency | |
  | AWS CodeBuild (`.monitorCodeBuildProject()`) | Build counts (total, successful, failed), failed rate, duration | Failed build count/rate, duration | |
  | AWS DocumentDB (`.monitorDocumentDbCluster()`) | CPU, throttling, read/write latency, transactions, cursors | CPU | |
  | AWS DynamoDB (`.monitorDynamoTable()`) | Read and write capacity provisioned / used | Consumed capacity, throttling, latency, errors | |
  | AWS DynamoDB Global Secondary Index (`.monitorDynamoTableGlobalSecondaryIndex()`) | Read and write capacity, indexing progress, throttled events | | |
  | AWS EC2 (`.monitorEC2Instances()`) | CPU, disk operations, network | | |
  | AWS EC2 Auto Scaling Groups (`.monitorAutoScalingGroup()`) | Group size, instance status | | |
  | AWS ECS (`.monitorFargateService()`, `.monitorEc2Service()`, `.monitorSimpleFargateService()`, `monitorSimpleEc2Service()`, `.monitorQueueProcessingFargateService()`, `.monitorQueueProcessingEc2Service()`) | System resources and task health | Unhealthy task count, running tasks count, CPU/memory usage, and bytes processed by load balancer (if any) | Use for ecs-patterns load balanced ec2/fargate constructs (NetworkLoadBalancedEc2Service, NetworkLoadBalancedFargateService, ApplicationLoadBalancedEc2Service, ApplicationLoadBalancedFargateService) |
  | AWS ElastiCache (`.monitorElastiCacheCluster()`) | CPU/memory usage, evictions and connections | CPU, memory, items count | |
  | AWS Glue (`.monitorGlueJob()`) | Traffic, job status, memory/CPU usage | Failed/killed task count/rate | |
  | AWS Kinesis Data Analytics (`.monitorKinesisDataAnalytics`) | Up/Downtime, CPU/memory usage, KPU usage, checkpoint metrics, and garbage collection metrics | Downtime, full restart count | |
  | AWS Kinesis Data Stream (`.monitorKinesisDataStream()`) | Put/Get/Incoming Record/s and Throttling | Throttling, throughput, iterator max age | |
  | AWS Kinesis Firehose (`.monitorKinesisFirehose()`) | Number of records, requests, latency, throttling | Throttling | |
  | AWS Lambda (`.monitorLambdaFunction()`) | Latency, errors, iterator max age | Latency, errors, throttles, iterator max age | Optional Lambda Insights metrics (opt-in) support |
  | AWS Load Balancing (`.monitorNetworkLoadBalancer()`, `.monitorFargateApplicationLoadBalancer()`, `.monitorFargateNetworkLoadBalancer()`, `.monitorEc2ApplicationLoadBalancer()`, `.monitorEc2NetworkLoadBalancer()`) | System resources and task health | Unhealthy task count, running tasks count, (for Fargate/Ec2 apps) CPU/memory usage | Use for FargateService or Ec2Service backed by a NetworkLoadBalancer or ApplicationLoadBalancer |
  | AWS OpenSearch/Elasticsearch (`.monitorOpenSearchCluster()`, `.monitorElasticsearchCluster()`) | Indexing and search latency, disk/memory/CPU usage | Indexing and search latency, disk/memory/CPU usage, cluster status, KMS keys | |
  | AWS RDS (`.monitorRdsCluster()`) | Query duration, connections, latency, disk/CPU usage | Connections, disk and CPU usage | |
  | AWS RDS (`.monitorRdsInstance()`) | Query duration, connections, latency, disk/CPU usage | Connections, disk and CPU usage | |
  | AWS Redshift (`.monitorRedshiftCluster()`) | Query duration, connections, latency, disk/CPU usage | Query duration, connections, disk and CPU usage | |
  | AWS S3 Bucket (`.monitorS3Bucket()`) | Bucket size and number of objects | | |
  | AWS SecretsManager (`.monitorSecretsManager()`) | Max secret count, min secret sount, secret count change | Min/max secret count or change in secret count | |
  | AWS SecretsManager Secret (`.monitorSecretsManagerSecret()`) | Days since last rotation | Days since last change or rotation | |
  | AWS SNS Topic (`.monitorSnsTopic()`) | Message count, size, failed notifications | Failed notifications, min/max published messages | |
  | AWS SQS Queue (`.monitorSqsQueue()`, `.monitorSqsQueueWithDlq()`) | Message count, age, size | Message count, age, DLQ incoming messages | |
  | AWS Step Functions (`.monitorStepFunction()`, `.monitorStepFunctionActivity()`, `monitorStepFunctionLambdaIntegration()`, `.monitorStepFunctionServiceIntegration()`) | Execution count and breakdown per state | Duration, failed, failed rate, aborted, throttled, timed out executions | |
  | AWS Web Application Firewall (`.monitorWebApplicationFirewallAclV2()`) | Allowed/blocked requests | Blocked requests count/rate | |
  | FluentBit (`.monitorFluentBit()`) | Num of input records, Output failures & retries, Filter metrics, Storage metrics | | FluentBit needs proper configuration with  metrics enabled: [Official sample configuration](https://github.com/aws-samples/amazon-ecs-firelens-examples/tree/mainline/examples/fluent-bit/send-fb-internal-metrics-to-cw). This function creates MetricFilters to publish all FluentBit metrics. |
  | Custom metrics (`.monitorCustom()`) | Addition of custom metrics into the dashboard (each group is a widget) | | Supports anomaly detection |





  *Important note*: **Please, do NOT import anything from the `/dist/lib` package.** This is unsupported and might break any time.

  1. Create an instance of `MonitoringFacade`, which is the main entrypoint.
  2. Call methods on the facade like `.monitorLambdaFunction()` and chain them together to define your monitors. You can also use methods to add your own widgets, headers of various sizes, and more.

  For examples of monitoring different resources, refer to [the unit tests](https://github.com/cdklabs/cdk-monitoring-constructs/tree/main/test/monitoring).

  ```python
  export interface MonitoringStackProps extends DeploymentStackProps {
    // ...
  }

  // This could be in the same stack as your resources, as a nested stack, or a separate stack as you see fit
  export class MonitoringStack extends DeploymentStack {
    constructor(parent: App, name: string, props: MonitoringStackProps) {
      super(parent, name, props);

      const monitoring = new MonitoringFacade(this, "Monitoring", {
        // Defaults are provided for these, but they can be customized as desired
        metricFactoryDefaults: { ... },
        alarmFactoryDefaults: { ... },
        dashboardFactory: { ... },
      });

      // Monitor your resources
      monitoring
        .addLargeHeader("Storage")
        .monitorDynamoTable({ /* Monitor a DynamoDB table */ })
        .monitorDynamoTable({ /* and a different table */ })
        .monitorLambdaFunction({ /* and a Lambda function */ })
        .monitorCustom({ /* and some arbitrary metrics in CloudWatch */ })
        // ... etc.
    }
  }
  ```



  Alarms should have an action setup, otherwise they are not very useful. Currently, we support notifying an SNS topic.

  ```python
  const onAlarmTopic = new Topic(this, "AlarmTopic");

  const monitoring = new MonitoringFacade(this, "Monitoring", {
    // ...other props
    alarmFactoryDefaults: {
      // ....other props
      action: new SnsAlarmActionStrategy({ onAlarmTopic }),
    },
  });
  ```

  You can override the default topic for any alarm like this:

  ```python
  monitoring
    .monitorSomething(something, {
      addSomeAlarm: {
        Warning: {
          // ...other props
          threshold: 42,
          actionOverride: new SnsAlarmActionStrategy({ onAlarmTopic }),
        }
      }
    });
  ```



  For simply adding some custom metrics, you can use `.monitorCustom()` and specify your own title and metric groups.
  Each metric group will be rendered as a single graph widget, and all widgets will be placed next to each other.
  All the widgets will have the same size, which is chosen based on the number of groups to maximize dashboard space usage.

  Custom metric monitoring can be created for simple metrics, simple metrics with anomaly detection and search metrics.
  The first two also support alarming.

  Below we are listing a couple of examples. Let us assume that there are three existing metric variables: `m1`, `m2`, `m3`.
  They can either be created by hand (`new Metric({...})`) or (preferably) by using `metricFactory` (that can be obtained from facade).
  The advantage of using the shared `metricFactory` is that you do not need to worry about period, etc.

  ```python
  // create metrics manually
  const m1 = new Metric(/* ... */);
  ```

  ```python
  const metricFactory = monitoringFacade.createMetricFactory();

  // create metrics using metric factory
  const m1 = metricFactory.createMetric(/* ... */);
  ```



  In this case, only one metric is supported.
  Multiple metrics cannot be rendered with anomaly detection in a single widget due to a CloudWatch limitation.

  ```python
  monitorCustom({
    title: "Metric with anomaly detection",
    metricGroups: [
      {
        metric: m1,
        anomalyDetectionStandardDeviationToRender: 3
      }
    ]
  })
  ```

  Adding an alarm:

  ```python
  monitorCustom({
    title: "Metric with anomaly detection and alarm",
    metricGroups: [
      {
        metric: m1,
        alarmFriendlyName: "MetricWithAnomalyDetectionAlarm",
        anomalyDetectionStandardDeviationToRender: 3,
        addAlarmOnAnomaly: {
          Warning: {
            standardDeviationForAlarm: 4,
            alarmWhenAboveTheBand: true,
            alarmWhenBelowTheBand: true
          }
        }
      }
    ]
  })
  ```



  ```python
  monitorCustom({
    title: "Metric search",
    metricGroups: [
      {
        searchQuery: "My.Prefix.",
        dimensionsMap: {
          FirstDimension: "FirstDimensionValue",
          // Allow any value for the given dimension (pardon the weird typing to satisfy DimensionsMap)
          SecondDimension: undefined as unknown as string
        }
        statistic: MetricStatistic.SUM,
      }
    ]
  })
  ```

  Search metrics do not support setting an alarm, which is a CloudWatch limitation.



  Route53 has [strict requirements](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/health-checks-types.html) as to which alarms are allowed to be referenced in Health Checks.
  You adjust the metric for an alarm so that it can be used in a Route53 Health Checks as follows:

  ```python
  monitoring
    .monitorSomething(something, {
      addSomeAlarm: {
        Warning: {
          // ...other props
          metricAdjuster: Route53HealthCheckMetricAdjuster.INSTANCE,
        }
      }
    });
  ```

  This will ensure the alarm can be used on a Route53 Health Check or otherwise throw an `Error` indicating why the alarm can't be used.
  In order to easily find your Route53 Health Check alarms later on, you can apply a custom tag to them as follows:

  ```python
  import { CfnHealthCheck } from "aws-cdk-lib/aws-route53";

  monitoring
    .monitorSomething(something, {
      addSomeAlarm: {
        Warning: {
          // ...other props
          customTags: ["route53-health-check"],
          metricAdjuster: Route53HealthCheckMetricAdjuster.INSTANCE,
        }
      }
    });

  const alarms = monitoring.createdAlarmsWithTag("route53-health-check");

  const healthChecks = alarms.map(({ alarm }) => {
    const id = getHealthCheckConstructId(alarm);

    return new CfnHealthCheck(scope, id, {
      healthCheckConfig: {
        // ...other props
        type: "CLOUDWATCH_METRIC",
        alarmIdentifier: {
          name: alarm.alarmName,
          region: alarm.stack.region,
        },
      },
    });
  });
  ```



  If you want even more flexibility, you can create your own segment.

  This is a general procedure on how to do it:

  1. Extend the `Monitoring` class
  2. Override the `widgets()` method (and/or similar ones)
  3. Leverage the metric factory and alarm factory provided by the base class (you can create additional factories, if you will)
  4. Add all alarms to `.addAlarm()` so they are visible to the user and being placed on the alarm summary dashboard

  Both of these monitoring base classes are dashboard segments, so you can add them to your monitoring by calling `.addSegment()` on the `MonitoringFacade`.



  While the dashboard widgets defined in the library are meant to cover most use cases, they might not be what you're looking for.

  To modify the widgets:

  1. Extend the appropriate `Monitoring` class (e.g., `LambdaFunctionMonitoring` for `monitorLambdaFunction`) and override the relevant methods (e.g., `widgets`):

     ```python
     export class MyCustomizedLambdaFunctionMonitoring extends LambdaFunctionMonitoring {
       widgets(): IWidget[] {
         return [
           // Whatever widgets you want instead of what LambdaFunctionMonitoring has
         ];
       }
     }
     ```
  2. Use the facade's `addSegment` method with your custom class:

     ```python
     declare const facade: MonitoringFacade;

     facade.addSegment(new MyCustomizedLambdaFunctionMonitoring(facade, {
       // Props for LambdaFunctionMonitoring
     }));
     ```



  If you want *even* more flexibility, you can take complete control over dashboard generation by leveraging dynamic dashboarding features. This allows you to create an arbitrary number of dashboards while configuring each of them separately. You can do this in three simple steps:

  1. Create a dynamic dashboard factory
  2. Create `IDynamicDashboardSegment` implementations
  3. Add Dynamic Segments to your `MonitoringFacade`



  The below code sample will generate two dashboards with the following names:

  * ExampleDashboards-HostedService
  * ExampleDashboards-Infrastructure

  ```python
  // create the dynamic dashboard factory.
  const factory = new DynamicDashboardFactory(stack, "DynamicDashboards", {
    dashboardNamePrefix: "ExampleDashboards",
    dashboardConfigs: [
      // 'name' is the minimum required configuration
      { name: "HostedService" },
      // below is an example of additional dashboard-specific config options
      {
        name: "Infrastructure",
        range: Duration.hours(3),
        periodOverride: PeriodOverride.AUTO,
        renderingPreference: DashboardRenderingPreference.BITMAP_ONLY
      },
    ],
  });
  ```



  For each construct you want monitored, you will need to create an implementation of an `IDynamicDashboardSegment`. The following is a basic reference implementation as an example:

  ```python
  export enum DashboardTypes {
    HostedService = "HostedService",
    Infrastructure = "Infrastructure",
  }

  class ExampleSegment implements IDynamicDashboardSegment {
    widgetsForDashboard(name: string): IWidget[] {
      // this logic is what's responsible for allowing your dynamic segment to return
      // different widgets for different dashboards
      switch (name) {
        case DashboardTypes.HostedService:
          return [new TextWidget({ markdown: "This shows metrics for your service hosted on AWS Infrastructure" })];
        case DashboardTypes.Infrastructure:
          return [new TextWidget({ markdown: "This shows metrics for the AWS Infrastructure supporting your hosted service" })];
        default:
          throw new Error("Unexpected dashboard name!");
      }
    }
  }
  ```



  When you have instances of an `IDynamicDashboardSegment` to use, they can be added to your dashboard like this:

  ```python
  monitoring.addDynamicSegment(new ExampleSegment());
  ```

  Now, this widget will be added to both dashboards and will show different content depending on the dashboard. Using the above example code, two dashboards will be generated with the following content:

  * Dashboard Name: "ExampleDashboards-HostedService"

    * Content: "This shows metrics for your service hosted on AWS Infrastructure"
  * Dashboard Name: "ExampleDashboards-Infrastructure"

    * Content: "This shows metrics for the AWS Infrastructure supporting your hosted service"



  Facades can be configured for different regions/accounts as a whole:

  ```python
  new MonitoringFacade(stack, "Monitoring", {
    metricFactoryDefaults: {
      // Different region/account than what you're deploying to
      region: "us-west-2",
      account: "01234567890",
    }
  });
  ```

  Or at a more granular level:

  ```python
  monitoring
    .monitorDynamoTable({
      // Table from the same account/region
      table: Table.fromTableName(stack, "ImportedTable", "MyTableName"),
    })
    .monitorDynamoTable({
      // Table from another account/region
      table: Table.fromTableArn(
        stack,
        "XaXrImportedTable",
        "arn:aws:dynamodb:us-west-2:01234567890:table/my-other-table",
      ),
      region: "us-west-2",
      account: "01234567890",
    });
  ```

  The order of precedence of the region/account values is:

  1. The individual metric factory's props (e.g. via the `monitorDynamoTable` props).
  2. The facade's `metricFactoryDefaults` props.
  3. The region/account that the stack is deployed to.

  Note that while this allows for cross-account cross-Region dashboarding, cross-Region alarming is not supported by CloudWatch.



  You can monitor complete CDK construct scopes using an aspect. It will automatically discover all monitorable resources within the scope recursively and add them to your dashboard.

  ```python
  monitoring.monitorScope(stack, {
    // With optional configuration
    lambda: {
      props: {
        addLatencyP50Alarm: {
          Critical: { maxLatency: Duration.seconds(10) },
        },
      },
    },

    // Some resources that aren't dependent on nodes (e.g. general metrics across instances/account) may be included
    // by default, which can be explicitly disabled.
    billing: { enabled: false },
    ec2: { enabled: false },
    elasticCache: { enabled: false },
  });
  ```



  See [CONTRIBUTING](CONTRIBUTING.md) for more information.



  See [SECURITY](SECURITY.md) for more information.



  This project is licensed under the Apache-2.0 License.


pkgId: 9923527d84cc9e97ecf78ea0310d73ccf35b975f5d64a00cb1cb5c916661287a
name: python-cdk-nag
arch: src
version: 2.28.195
epoch: 0
release: 1
summary: Check CDK v2 applications for best practices using a combination on available rule packs.
url: https://github.com/cdklabs/cdk-nag.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-nag-2.28.195-1.src.rpm
checksum_type: sha256
description:
  <!--
  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  SPDX-License-Identifier: Apache-2.0
  -->



  [![PyPI version](https://img.shields.io/pypi/v/cdk-nag)](https://pypi.org/project/cdk-nag/)
  [![npm version](https://img.shields.io/npm/v/cdk-nag)](https://www.npmjs.com/package/cdk-nag)
  [![Maven version](https://img.shields.io/maven-central/v/io.github.cdklabs/cdknag)](https://search.maven.org/search?q=a:cdknag)
  [![NuGet version](https://img.shields.io/nuget/v/Cdklabs.CdkNag)](https://www.nuget.org/packages/Cdklabs.CdkNag)
  [![Go version](https://img.shields.io/github/go-mod/go-version/cdklabs/cdk-nag-go?color=blue&filename=cdknag%2Fgo.mod)](https://github.com/cdklabs/cdk-nag-go)

  [![View on Construct Hub](https://constructs.dev/badge?package=cdk-nag)](https://constructs.dev/packages/cdk-nag)

  Check CDK applications or [CloudFormation templates](#using-on-cloudformation-templates) for best practices using a combination of available rule packs. Inspired by [cfn_nag](https://github.com/stelligent/cfn_nag).

  Check out [this blog post](https://aws.amazon.com/blogs/devops/manage-application-security-and-compliance-with-the-aws-cloud-development-kit-and-cdk-nag/) for a guided overview!

  ![demo](cdk_nag.gif)



  See [RULES](./RULES.md) for more information on all the available packs.

  1. [AWS Solutions](./RULES.md#awssolutions)
  2. [HIPAA Security](./RULES.md#hipaa-security)
  3. [NIST 800-53 rev 4](./RULES.md#nist-800-53-rev-4)
  4. [NIST 800-53 rev 5](./RULES.md#nist-800-53-rev-5)
  5. [PCI DSS 3.2.1](./RULES.md#pci-dss-321)

  [RULES](./RULES.md) also includes a collection of [additional rules](./RULES.md#additional-rules) that are not currently included in any of the pre-built NagPacks, but are still available for inclusion in custom NagPacks.

  Read the [NagPack developer docs](./docs/NagPack.md) if you are interested in creating your own pack.



  For a full list of options See `NagPackProps` in the [API.md](./API.md#struct-nagpackprops)

  <details>
  <summary>Including in an application</summary>

  ```python
  import { App, Aspects } from 'aws-cdk-lib';
  import { CdkTestStack } from '../lib/cdk-test-stack';
  import { AwsSolutionsChecks } from 'cdk-nag';

  const app = new App();
  new CdkTestStack(app, 'CdkNagDemo');
  // Simple rule informational messages
  Aspects.of(app).add(new AwsSolutionsChecks());
  // Additional explanations on the purpose of triggered rules
  // Aspects.of(stack).add(new AwsSolutionsChecks({ verbose: true }));
  ```

  </details>



  <details>
    <summary>Example 1) Default Construct</summary>

  ```python
  import { SecurityGroup, Vpc, Peer, Port } from 'aws-cdk-lib/aws-ec2';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { NagSuppressions } from 'cdk-nag';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      const test = new SecurityGroup(this, 'test', {
        vpc: new Vpc(this, 'vpc'),
      });
      test.addIngressRule(Peer.anyIpv4(), Port.allTraffic());
      NagSuppressions.addResourceSuppressions(test, [
        { id: 'AwsSolutions-EC23', reason: 'lorem ipsum' },
      ]);
    }
  }
  ```

  </details><details>
    <summary>Example 2) On Multiple Constructs</summary>

  ```python
  import { SecurityGroup, Vpc, Peer, Port } from 'aws-cdk-lib/aws-ec2';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { NagSuppressions } from 'cdk-nag';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      const vpc = new Vpc(this, 'vpc');
      const test1 = new SecurityGroup(this, 'test', { vpc });
      test1.addIngressRule(Peer.anyIpv4(), Port.allTraffic());
      const test2 = new SecurityGroup(this, 'test', { vpc });
      test2.addIngressRule(Peer.anyIpv4(), Port.allTraffic());
      NagSuppressions.addResourceSuppressions(
        [test1, test2],
        [{ id: 'AwsSolutions-EC23', reason: 'lorem ipsum' }]
      );
    }
  }
  ```

  </details><details>
    <summary>Example 3) Child Constructs</summary>

  ```python
  import { User, PolicyStatement } from 'aws-cdk-lib/aws-iam';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { NagSuppressions } from 'cdk-nag';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      const user = new User(this, 'rUser');
      user.addToPolicy(
        new PolicyStatement({
          actions: ['s3:PutObject'],
          resources: ['arn:aws:s3:::bucket_name/*'],
        })
      );
      // Enable adding suppressions to child constructs
      NagSuppressions.addResourceSuppressions(
        user,
        [
          {
            id: 'AwsSolutions-IAM5',
            reason: 'lorem ipsum',
            appliesTo: ['Resource::arn:aws:s3:::bucket_name/*'], // optional
          },
        ],
        true
      );
    }
  }
  ```

  </details><details>
    <summary>Example 4) Stack Level </summary>

  ```python
  import { App, Aspects } from 'aws-cdk-lib';
  import { CdkTestStack } from '../lib/cdk-test-stack';
  import { AwsSolutionsChecks, NagSuppressions } from 'cdk-nag';

  const app = new App();
  const stack = new CdkTestStack(app, 'CdkNagDemo');
  Aspects.of(app).add(new AwsSolutionsChecks());
  NagSuppressions.addStackSuppressions(stack, [
    { id: 'AwsSolutions-EC23', reason: 'lorem ipsum' },
  ]);
  ```

  </details><details>
    <summary>Example 5) Construct path</summary>

  If you received the following error on synth/deploy

  ```bash
  [Error at /StackName/Custom::CDKBucketDeployment8675309/ServiceRole/Resource] AwsSolutions-IAM4: The IAM user, role, or group uses AWS managed policies
  ```

  ```python
  import { Bucket } from 'aws-cdk-lib/aws-s3';
  import { BucketDeployment } from 'aws-cdk-lib/aws-s3-deployment';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { NagSuppressions } from 'cdk-nag';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      new BucketDeployment(this, 'rDeployment', {
        sources: [],
        destinationBucket: Bucket.fromBucketName(this, 'rBucket', 'foo'),
      });
      NagSuppressions.addResourceSuppressionsByPath(
        this,
        '/StackName/Custom::CDKBucketDeployment8675309/ServiceRole/Resource',
        [{ id: 'AwsSolutions-IAM4', reason: 'at least 10 characters' }]
      );
    }
  }
  ```

  </details><details>
    <summary>Example 6) Granular Suppressions of findings</summary>

  Certain rules support granular suppressions of `findings`. If you received the following errors on synth/deploy

  ```bash
  [Error at /StackName/rFirstUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Action::s3:*]: The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission.
  [Error at /StackName/rFirstUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Resource::*]: The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission.
  [Error at /StackName/rSecondUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Action::s3:*]: The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission.
  [Error at /StackName/rSecondUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Resource::*]: The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission.
  ```

  By applying the following suppressions

  ```python
  import { User } from 'aws-cdk-lib/aws-iam';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { NagSuppressions } from 'cdk-nag';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      const firstUser = new User(this, 'rFirstUser');
      firstUser.addToPolicy(
        new PolicyStatement({
          actions: ['s3:*'],
          resources: ['*'],
        })
      );
      const secondUser = new User(this, 'rSecondUser');
      secondUser.addToPolicy(
        new PolicyStatement({
          actions: ['s3:*'],
          resources: ['*'],
        })
      );
      const thirdUser = new User(this, 'rSecondUser');
      thirdUser.addToPolicy(
        new PolicyStatement({
          actions: ['sqs:CreateQueue'],
          resources: [`arn:aws:sqs:${this.region}:${this.account}:*`],
        })
      );
      NagSuppressions.addResourceSuppressions(
        firstUser,
        [
          {
            id: 'AwsSolutions-IAM5',
            reason:
              "Only suppress AwsSolutions-IAM5 's3:*' finding on First User.",
            appliesTo: ['Action::s3:*'],
          },
        ],
        true
      );
      NagSuppressions.addResourceSuppressions(
        secondUser,
        [
          {
            id: 'AwsSolutions-IAM5',
            reason: 'Suppress all AwsSolutions-IAM5 findings on Second User.',
          },
        ],
        true
      );
      NagSuppressions.addResourceSuppressions(
        thirdUser,
        [
          {
            id: 'AwsSolutions-IAM5',
            reason: 'Suppress AwsSolutions-IAM5 on the SQS resource.',
            appliesTo: [
              {
                regex: '/^Resource::arn:aws:sqs:(.*):\\*$/g',
              },
            ],
          },
        ],
        true
      );
    }
  }
  ```

  You would see the following error on synth/deploy

  ```bash
  [Error at /StackName/rFirstUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Resource::*]: The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission.
  ```

  </details>



  The [aws-cdk-lib/pipelines.CodePipeline](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.pipelines.CodePipeline.html) construct and its child constructs are not guaranteed to be "Visited" by `Aspects`, as they are not added during the "Construction" phase of the [cdk lifecycle](https://docs.aws.amazon.com/cdk/v2/guide/apps.html#lifecycle). Because of this behavior, you may experience problems such as rule violations not appearing or the inability to suppress violations on these constructs.

  You can remediate these rule violation and suppression problems by forcing the pipeline construct creation forward by calling `.buildPipeline()` on your `CodePipeline` object. Otherwise you may see errors such as:

  ```
  Error: Suppression path "/this/construct/path" did not match any resource. This can occur when a resource does not exist or if a suppression is applied before a resource is created.
  ```

  See [this issue](https://github.com/aws/aws-cdk/issues/18440) for more information.

  <details>
    <summary>Example) Suppressing Violations in Pipelines</summary>

  `example-app.ts`

  ```python
  import { App, Aspects } from 'aws-cdk-lib';
  import { AwsSolutionsChecks } from 'cdk-nag';
  import { ExamplePipeline } from '../lib/example-pipeline';

  const app = new App();
  new ExamplePipeline(app, 'example-cdk-pipeline');
  Aspects.of(app).add(new AwsSolutionsChecks({ verbose: true }));
  app.synth();
  ```

  `example-pipeline.ts`

  ```python
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Repository } from 'aws-cdk-lib/aws-codecommit';
  import {
    CodePipeline,
    CodePipelineSource,
    ShellStep,
  } from 'aws-cdk-lib/pipelines';
  import { NagSuppressions } from 'cdk-nag';
  import { Construct } from 'constructs';

  export class ExamplePipeline extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);

      const exampleSynth = new ShellStep('ExampleSynth', {
        commands: ['yarn build --frozen-lockfile'],
        input: CodePipelineSource.codeCommit(
          new Repository(this, 'ExampleRepo', { repositoryName: 'ExampleRepo' }),
          'main'
        ),
      });

      const ExamplePipeline = new CodePipeline(this, 'ExamplePipeline', {
        synth: exampleSynth,
      });

      // Force the pipeline construct creation forward before applying suppressions.
      // @See https://github.com/aws/aws-cdk/issues/18440
      ExamplePipeline.buildPipeline();

      // The path suppression will error if you comment out "ExamplePipeline.buildPipeline();""
      NagSuppressions.addResourceSuppressionsByPath(
        this,
        '/example-cdk-pipeline/ExamplePipeline/Pipeline/ArtifactsBucket/Resource',
        [
          {
            id: 'AwsSolutions-S1',
            reason: 'Because I said so',
          },
        ]
      );
    }
  }
  ```

  </details>



  In some cases L2 Constructs do not have a native option to remediate an issue and must be fixed via [Raw Overrides](https://docs.aws.amazon.com/cdk/latest/guide/cfn_layer.html#cfn_layer_raw). Since raw overrides take place after template synthesis these fixes are not caught by cdk-nag. In this case you should remediate the issue and suppress the issue like in the following example.

  <details>
    <summary>Example) Property Overrides</summary>

  ```python
  import {
    Instance,
    InstanceType,
    InstanceClass,
    MachineImage,
    Vpc,
    CfnInstance,
  } from 'aws-cdk-lib/aws-ec2';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { NagSuppressions } from 'cdk-nag';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      const instance = new Instance(this, 'rInstance', {
        vpc: new Vpc(this, 'rVpc'),
        instanceType: new InstanceType(InstanceClass.T3),
        machineImage: MachineImage.latestAmazonLinux(),
      });
      const cfnIns = instance.node.defaultChild as CfnInstance;
      cfnIns.addPropertyOverride('DisableApiTermination', true);
      NagSuppressions.addResourceSuppressions(instance, [
        {
          id: 'AwsSolutions-EC29',
          reason: 'Remediated through property override.',
        },
      ]);
    }
  }
  ```

  </details>



  You can optionally create a condition that prevents certain rules from being suppressed. You can create conditions for any variety of reasons. Examples include a condition that always ignores a suppression, a condition that ignores a suppression based on the date, a condition that ignores a suppression based on the reason. You can read [the developer docs](./docs/IgnoreSuppressionConditions.md) for more information on creating your own conditions.

  <details>
    <summary>Example) Using the pre-built `SuppressionIgnoreErrors` class to ignore suppressions on any `Error` level rules.</summary>

  ```python
  import { App, Aspects } from 'aws-cdk-lib';
  import { CdkTestStack } from '../lib/cdk-test-stack';
  import { AwsSolutionsChecks, SuppressionIgnoreErrors } from 'cdk-nag';

  const app = new App();
  new CdkTestStack(app, 'CdkNagDemo');
  // Ignore Suppressions on any errors
  Aspects.of(app).add(
    new AwsSolutionsChecks({
      suppressionIgnoreCondition: new SuppressionIgnoreErrors(),
    })
  );
  ```

  </details>



  `NagLogger`s give `NagPack` authors and users the ability to create their own custom reporting mechanisms. All pre-built `NagPacks`come with the `AnnotationsLogger`and the `NagReportLogger` (with CSV reports) enabled by default.

  See the [NagLogger](./docs/NagLogger.md) developer docs for more information.

  <details>
    <summary>Example) Adding the `ExtremelyHelpfulConsoleLogger` example from the NagLogger docs</summary>

  ```python
  import { App, Aspects } from 'aws-cdk-lib';
  import { CdkTestStack } from '../lib/cdk-test-stack';
  import { ExtremelyHelpfulConsoleLogger } from './docs/NagLogger';
  import { AwsSolutionsChecks } from 'cdk-nag';

  const app = new App();
  new CdkTestStack(app, 'CdkNagDemo');
  Aspects.of(app).add(
    new AwsSolutionsChecks({
      additionalLoggers: [new ExtremelyHelpfulConsoleLogger()],
    })
  );
  ```

  </details>



  You can use cdk-nag on existing CloudFormation templates by using the [cloudformation-include](https://docs.aws.amazon.com/cdk/latest/guide/use_cfn_template.html#use_cfn_template_install) module.

  <details>
    <summary>Example 1) CloudFormation template with suppression</summary>

  Sample CloudFormation template with suppression

  ```json
  {
    "Resources": {
      "rBucket": {
        "Type": "AWS::S3::Bucket",
        "Properties": {
          "BucketName": "some-bucket-name"
        },
        "Metadata": {
          "cdk_nag": {
            "rules_to_suppress": [
              {
                "id": "AwsSolutions-S1",
                "reason": "at least 10 characters"
              }
            ]
          }
        }
      }
    }
  }
  ```

  Sample App

  ```python
  import { App, Aspects } from 'aws-cdk-lib';
  import { CdkTestStack } from '../lib/cdk-test-stack';
  import { AwsSolutionsChecks } from 'cdk-nag';

  const app = new App();
  new CdkTestStack(app, 'CdkNagDemo');
  Aspects.of(app).add(new AwsSolutionsChecks());
  ```

  Sample Stack with imported template

  ```python
  import { CfnInclude } from 'aws-cdk-lib/cloudformation-include';
  import { NagSuppressions } from 'cdk-nag';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      new CfnInclude(this, 'Template', {
        templateFile: 'my-template.json',
      });
      // Add any additional suppressions
      NagSuppressions.addResourceSuppressionsByPath(
        this,
        '/CdkNagDemo/Template/rBucket',
        [
          {
            id: 'AwsSolutions-S2',
            reason: 'at least 10 characters',
          },
        ]
      );
    }
  }
  ```

  </details><details>
    <summary>Example 2) CloudFormation template with granular suppressions</summary>

  Sample CloudFormation template with suppression

  ```json
  {
    "Resources": {
      "myPolicy": {
        "Type": "AWS::IAM::Policy",
        "Properties": {
          "PolicyDocument": {
            "Statement": [
              {
                "Action": [
                  "kms:Decrypt",
                  "kms:DescribeKey",
                  "kms:Encrypt",
                  "kms:ReEncrypt*",
                  "kms:GenerateDataKey*"
                ],
                "Effect": "Allow",
                "Resource": ["some-key-arn"]
              }
            ],
            "Version": "2012-10-17"
          }
        },
        "Metadata": {
          "cdk_nag": {
            "rules_to_suppress": [
              {
                "id": "AwsSolutions-IAM5",
                "reason": "Allow key data access",
                "applies_to": [
                  "Action::kms:ReEncrypt*",
                  "Action::kms:GenerateDataKey*"
                ]
              }
            ]
          }
        }
      }
    }
  }
  ```

  Sample App

  ```python
  import { App, Aspects } from 'aws-cdk-lib';
  import { CdkTestStack } from '../lib/cdk-test-stack';
  import { AwsSolutionsChecks } from 'cdk-nag';

  const app = new App();
  new CdkTestStack(app, 'CdkNagDemo');
  Aspects.of(app).add(new AwsSolutionsChecks());
  ```

  Sample Stack with imported template

  ```python
  import { CfnInclude } from 'aws-cdk-lib/cloudformation-include';
  import { NagSuppressions } from 'cdk-nag';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      new CfnInclude(this, 'Template', {
        templateFile: 'my-template.json',
      });
      // Add any additional suppressions
      NagSuppressions.addResourceSuppressionsByPath(
        this,
        '/CdkNagDemo/Template/myPolicy',
        [
          {
            id: 'AwsSolutions-IAM5',
            reason: 'Allow key data access',
            appliesTo: ['Action::kms:ReEncrypt*', 'Action::kms:GenerateDataKey*'],
          },
        ]
      );
    }
  }
  ```

  </details>



  See [CONTRIBUTING](./CONTRIBUTING.md) for more information.



  This project is licensed under the Apache-2.0 License.


pkgId: 4f0badf78de84e931748644288ebd03e3b7f022779ed6222294c538b8be2db35
name: python-cdk-nag
arch: src
version: 2.34.0
epoch: 0
release: 1
summary: Check CDK v2 applications for best practices using a combination on available rule packs.
url: https://github.com/cdklabs/cdk-nag.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-nag-2.34.0-1.src.rpm
checksum_type: sha256
description:
  <!--
  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  SPDX-License-Identifier: Apache-2.0
  -->



  [![PyPI version](https://img.shields.io/pypi/v/cdk-nag)](https://pypi.org/project/cdk-nag/)
  [![npm version](https://img.shields.io/npm/v/cdk-nag)](https://www.npmjs.com/package/cdk-nag)
  [![Maven version](https://img.shields.io/maven-central/v/io.github.cdklabs/cdknag)](https://search.maven.org/search?q=a:cdknag)
  [![NuGet version](https://img.shields.io/nuget/v/Cdklabs.CdkNag)](https://www.nuget.org/packages/Cdklabs.CdkNag)
  [![Go version](https://img.shields.io/github/go-mod/go-version/cdklabs/cdk-nag-go?color=blue&filename=cdknag%2Fgo.mod)](https://github.com/cdklabs/cdk-nag-go)

  [![View on Construct Hub](https://constructs.dev/badge?package=cdk-nag)](https://constructs.dev/packages/cdk-nag)

  Check CDK applications or [CloudFormation templates](#using-on-cloudformation-templates) for best practices using a combination of available rule packs. Inspired by [cfn_nag](https://github.com/stelligent/cfn_nag).

  Check out [this blog post](https://aws.amazon.com/blogs/devops/manage-application-security-and-compliance-with-the-aws-cloud-development-kit-and-cdk-nag/) for a guided overview!

  ![demo](cdk_nag.gif)



  See [RULES](./RULES.md) for more information on all the available packs.

  1. [AWS Solutions](./RULES.md#awssolutions)
  2. [HIPAA Security](./RULES.md#hipaa-security)
  3. [NIST 800-53 rev 4](./RULES.md#nist-800-53-rev-4)
  4. [NIST 800-53 rev 5](./RULES.md#nist-800-53-rev-5)
  5. [PCI DSS 3.2.1](./RULES.md#pci-dss-321)

  [RULES](./RULES.md) also includes a collection of [additional rules](./RULES.md#additional-rules) that are not currently included in any of the pre-built NagPacks, but are still available for inclusion in custom NagPacks.

  Read the [NagPack developer docs](./docs/NagPack.md) if you are interested in creating your own pack.



  For a full list of options See `NagPackProps` in the [API.md](./API.md#struct-nagpackprops)

  <details>
  <summary>Including in an application</summary>

  ```python
  import { App, Aspects } from 'aws-cdk-lib';
  import { CdkTestStack } from '../lib/cdk-test-stack';
  import { AwsSolutionsChecks } from 'cdk-nag';

  const app = new App();
  new CdkTestStack(app, 'CdkNagDemo');
  // Simple rule informational messages
  Aspects.of(app).add(new AwsSolutionsChecks());
  // Additional explanations on the purpose of triggered rules
  // Aspects.of(stack).add(new AwsSolutionsChecks({ verbose: true }));
  ```

  </details>



  <details>
    <summary>Example 1) Default Construct</summary>

  ```python
  import { SecurityGroup, Vpc, Peer, Port } from 'aws-cdk-lib/aws-ec2';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { NagSuppressions } from 'cdk-nag';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      const test = new SecurityGroup(this, 'test', {
        vpc: new Vpc(this, 'vpc'),
      });
      test.addIngressRule(Peer.anyIpv4(), Port.allTraffic());
      NagSuppressions.addResourceSuppressions(test, [
        { id: 'AwsSolutions-EC23', reason: 'lorem ipsum' },
      ]);
    }
  }
  ```

  </details><details>
    <summary>Example 2) On Multiple Constructs</summary>

  ```python
  import { SecurityGroup, Vpc, Peer, Port } from 'aws-cdk-lib/aws-ec2';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { NagSuppressions } from 'cdk-nag';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      const vpc = new Vpc(this, 'vpc');
      const test1 = new SecurityGroup(this, 'test', { vpc });
      test1.addIngressRule(Peer.anyIpv4(), Port.allTraffic());
      const test2 = new SecurityGroup(this, 'test', { vpc });
      test2.addIngressRule(Peer.anyIpv4(), Port.allTraffic());
      NagSuppressions.addResourceSuppressions(
        [test1, test2],
        [{ id: 'AwsSolutions-EC23', reason: 'lorem ipsum' }]
      );
    }
  }
  ```

  </details><details>
    <summary>Example 3) Child Constructs</summary>

  ```python
  import { User, PolicyStatement } from 'aws-cdk-lib/aws-iam';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { NagSuppressions } from 'cdk-nag';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      const user = new User(this, 'rUser');
      user.addToPolicy(
        new PolicyStatement({
          actions: ['s3:PutObject'],
          resources: ['arn:aws:s3:::bucket_name/*'],
        })
      );
      // Enable adding suppressions to child constructs
      NagSuppressions.addResourceSuppressions(
        user,
        [
          {
            id: 'AwsSolutions-IAM5',
            reason: 'lorem ipsum',
            appliesTo: ['Resource::arn:aws:s3:::bucket_name/*'], // optional
          },
        ],
        true
      );
    }
  }
  ```

  </details><details>
    <summary>Example 4) Stack Level </summary>

  ```python
  import { App, Aspects } from 'aws-cdk-lib';
  import { CdkTestStack } from '../lib/cdk-test-stack';
  import { AwsSolutionsChecks, NagSuppressions } from 'cdk-nag';

  const app = new App();
  const stack = new CdkTestStack(app, 'CdkNagDemo');
  Aspects.of(app).add(new AwsSolutionsChecks());
  NagSuppressions.addStackSuppressions(stack, [
    { id: 'AwsSolutions-EC23', reason: 'lorem ipsum' },
  ]);
  ```

  </details><details>
    <summary>Example 5) Construct path</summary>

  If you received the following error on synth/deploy

  ```bash
  [Error at /StackName/Custom::CDKBucketDeployment8675309/ServiceRole/Resource] AwsSolutions-IAM4: The IAM user, role, or group uses AWS managed policies
  ```

  ```python
  import { Bucket } from 'aws-cdk-lib/aws-s3';
  import { BucketDeployment } from 'aws-cdk-lib/aws-s3-deployment';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { NagSuppressions } from 'cdk-nag';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      new BucketDeployment(this, 'rDeployment', {
        sources: [],
        destinationBucket: Bucket.fromBucketName(this, 'rBucket', 'foo'),
      });
      NagSuppressions.addResourceSuppressionsByPath(
        this,
        '/StackName/Custom::CDKBucketDeployment8675309/ServiceRole/Resource',
        [{ id: 'AwsSolutions-IAM4', reason: 'at least 10 characters' }]
      );
    }
  }
  ```

  </details><details>
    <summary>Example 6) Granular Suppressions of findings</summary>

  Certain rules support granular suppressions of `findings`. If you received the following errors on synth/deploy

  ```bash
  [Error at /StackName/rFirstUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Action::s3:*]: The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission.
  [Error at /StackName/rFirstUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Resource::*]: The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission.
  [Error at /StackName/rSecondUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Action::s3:*]: The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission.
  [Error at /StackName/rSecondUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Resource::*]: The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission.
  ```

  By applying the following suppressions

  ```python
  import { User } from 'aws-cdk-lib/aws-iam';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { NagSuppressions } from 'cdk-nag';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      const firstUser = new User(this, 'rFirstUser');
      firstUser.addToPolicy(
        new PolicyStatement({
          actions: ['s3:*'],
          resources: ['*'],
        })
      );
      const secondUser = new User(this, 'rSecondUser');
      secondUser.addToPolicy(
        new PolicyStatement({
          actions: ['s3:*'],
          resources: ['*'],
        })
      );
      const thirdUser = new User(this, 'rSecondUser');
      thirdUser.addToPolicy(
        new PolicyStatement({
          actions: ['sqs:CreateQueue'],
          resources: [`arn:aws:sqs:${this.region}:${this.account}:*`],
        })
      );
      NagSuppressions.addResourceSuppressions(
        firstUser,
        [
          {
            id: 'AwsSolutions-IAM5',
            reason:
              "Only suppress AwsSolutions-IAM5 's3:*' finding on First User.",
            appliesTo: ['Action::s3:*'],
          },
        ],
        true
      );
      NagSuppressions.addResourceSuppressions(
        secondUser,
        [
          {
            id: 'AwsSolutions-IAM5',
            reason: 'Suppress all AwsSolutions-IAM5 findings on Second User.',
          },
        ],
        true
      );
      NagSuppressions.addResourceSuppressions(
        thirdUser,
        [
          {
            id: 'AwsSolutions-IAM5',
            reason: 'Suppress AwsSolutions-IAM5 on the SQS resource.',
            appliesTo: [
              {
                regex: '/^Resource::arn:aws:sqs:(.*):\\*$/g',
              },
            ],
          },
        ],
        true
      );
    }
  }
  ```

  You would see the following error on synth/deploy

  ```bash
  [Error at /StackName/rFirstUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Resource::*]: The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission.
  ```

  </details>



  When a rule validation fails it is handled similarly to a rule violation, and can be suppressed in the same manner. The `ID` for a rule failure is `CdkNagValidationFailure`.

  If a rule is suppressed in a non-granular manner (i.e. `appliesTo` is not set, see example 1 above) then validation failures on that rule are also suppressed.

  Validation failure suppression respects any applied [Suppression Ignore Conditions](#conditionally-ignoring-suppressions)

  <details>
    <summary>Example 1) Suppress all Validation Failures on a Resource</summary>

  ```python
  import { SecurityGroup, Vpc, Peer, Port } from 'aws-cdk-lib/aws-ec2';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { NagSuppressions } from 'cdk-nag';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      const test = new SecurityGroup(this, 'test', {
        vpc: new Vpc(this, 'vpc'),
      });
      test.addIngressRule(Peer.anyIpv4(), Port.allTraffic());
      NagSuppressions.addResourceSuppressions(test, [
        { id: 'CdkNagValidationFailure', reason: 'lorem ipsum' },
      ]);
    }
  }
  ```

  </details><details>
    <summary>Example 2) Granular Suppression of Validation Failures</summary>
  Validation failures can be suppressed for individual rules by using `appliesTo` to list the desired rules

  ```python
  import { SecurityGroup, Vpc, Peer, Port } from 'aws-cdk-lib/aws-ec2';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { NagSuppressions } from 'cdk-nag';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      const test = new SecurityGroup(this, 'test', {
        vpc: new Vpc(this, 'vpc'),
      });
      test.addIngressRule(Peer.anyIpv4(), Port.allTraffic());
      NagSuppressions.addResourceSuppressions(test, [
        {
          id: 'CdkNagValidationFailure',
          reason: 'lorem ipsum',
          appliesTo: ['AwsSolutions-L1'],
        },
      ]);
    }
  }
  ```

  </details>



  The [aws-cdk-lib/pipelines.CodePipeline](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.pipelines.CodePipeline.html) construct and its child constructs are not guaranteed to be "Visited" by `Aspects`, as they are not added during the "Construction" phase of the [cdk lifecycle](https://docs.aws.amazon.com/cdk/v2/guide/apps.html#lifecycle). Because of this behavior, you may experience problems such as rule violations not appearing or the inability to suppress violations on these constructs.

  You can remediate these rule violation and suppression problems by forcing the pipeline construct creation forward by calling `.buildPipeline()` on your `CodePipeline` object. Otherwise you may see errors such as:

  ```
  Error: Suppression path "/this/construct/path" did not match any resource. This can occur when a resource does not exist or if a suppression is applied before a resource is created.
  ```

  See [this issue](https://github.com/aws/aws-cdk/issues/18440) for more information.

  <details>
    <summary>Example) Suppressing Violations in Pipelines</summary>

  `example-app.ts`

  ```python
  import { App, Aspects } from 'aws-cdk-lib';
  import { AwsSolutionsChecks } from 'cdk-nag';
  import { ExamplePipeline } from '../lib/example-pipeline';

  const app = new App();
  new ExamplePipeline(app, 'example-cdk-pipeline');
  Aspects.of(app).add(new AwsSolutionsChecks({ verbose: true }));
  app.synth();
  ```

  `example-pipeline.ts`

  ```python
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Repository } from 'aws-cdk-lib/aws-codecommit';
  import {
    CodePipeline,
    CodePipelineSource,
    ShellStep,
  } from 'aws-cdk-lib/pipelines';
  import { NagSuppressions } from 'cdk-nag';
  import { Construct } from 'constructs';

  export class ExamplePipeline extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);

      const exampleSynth = new ShellStep('ExampleSynth', {
        commands: ['yarn build --frozen-lockfile'],
        input: CodePipelineSource.codeCommit(
          new Repository(this, 'ExampleRepo', { repositoryName: 'ExampleRepo' }),
          'main'
        ),
      });

      const ExamplePipeline = new CodePipeline(this, 'ExamplePipeline', {
        synth: exampleSynth,
      });

      // Force the pipeline construct creation forward before applying suppressions.
      // @See https://github.com/aws/aws-cdk/issues/18440
      ExamplePipeline.buildPipeline();

      // The path suppression will error if you comment out "ExamplePipeline.buildPipeline();""
      NagSuppressions.addResourceSuppressionsByPath(
        this,
        '/example-cdk-pipeline/ExamplePipeline/Pipeline/ArtifactsBucket/Resource',
        [
          {
            id: 'AwsSolutions-S1',
            reason: 'Because I said so',
          },
        ]
      );
    }
  }
  ```

  </details>



  In some cases L2 Constructs do not have a native option to remediate an issue and must be fixed via [Raw Overrides](https://docs.aws.amazon.com/cdk/latest/guide/cfn_layer.html#cfn_layer_raw). Since raw overrides take place after template synthesis these fixes are not caught by cdk-nag. In this case you should remediate the issue and suppress the issue like in the following example.

  <details>
    <summary>Example) Property Overrides</summary>

  ```python
  import {
    Instance,
    InstanceType,
    InstanceClass,
    MachineImage,
    Vpc,
    CfnInstance,
  } from 'aws-cdk-lib/aws-ec2';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { NagSuppressions } from 'cdk-nag';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      const instance = new Instance(this, 'rInstance', {
        vpc: new Vpc(this, 'rVpc'),
        instanceType: new InstanceType(InstanceClass.T3),
        machineImage: MachineImage.latestAmazonLinux(),
      });
      const cfnIns = instance.node.defaultChild as CfnInstance;
      cfnIns.addPropertyOverride('DisableApiTermination', true);
      NagSuppressions.addResourceSuppressions(instance, [
        {
          id: 'AwsSolutions-EC29',
          reason: 'Remediated through property override.',
        },
      ]);
    }
  }
  ```

  </details>



  You can optionally create a condition that prevents certain rules from being suppressed. You can create conditions for any variety of reasons. Examples include a condition that always ignores a suppression, a condition that ignores a suppression based on the date, a condition that ignores a suppression based on the reason. You can read [the developer docs](./docs/IgnoreSuppressionConditions.md) for more information on creating your own conditions.

  <details>
    <summary>Example) Using the pre-built `SuppressionIgnoreErrors` class to ignore suppressions on any `Error` level rules.</summary>

  ```python
  import { App, Aspects } from 'aws-cdk-lib';
  import { CdkTestStack } from '../lib/cdk-test-stack';
  import { AwsSolutionsChecks, SuppressionIgnoreErrors } from 'cdk-nag';

  const app = new App();
  new CdkTestStack(app, 'CdkNagDemo');
  // Ignore Suppressions on any errors
  Aspects.of(app).add(
    new AwsSolutionsChecks({
      suppressionIgnoreCondition: new SuppressionIgnoreErrors(),
    })
  );
  ```

  </details>



  `NagLogger`s give `NagPack` authors and users the ability to create their own custom reporting mechanisms. All pre-built `NagPacks`come with the `AnnotationsLogger`and the `NagReportLogger` (with CSV reports) enabled by default.

  See the [NagLogger](./docs/NagLogger.md) developer docs for more information.

  <details>
    <summary>Example) Adding the `ExtremelyHelpfulConsoleLogger` example from the NagLogger docs</summary>

  ```python
  import { App, Aspects } from 'aws-cdk-lib';
  import { CdkTestStack } from '../lib/cdk-test-stack';
  import { ExtremelyHelpfulConsoleLogger } from './docs/NagLogger';
  import { AwsSolutionsChecks } from 'cdk-nag';

  const app = new App();
  new CdkTestStack(app, 'CdkNagDemo');
  Aspects.of(app).add(
    new AwsSolutionsChecks({
      additionalLoggers: [new ExtremelyHelpfulConsoleLogger()],
    })
  );
  ```

  </details>



  You can use cdk-nag on existing CloudFormation templates by using the [cloudformation-include](https://docs.aws.amazon.com/cdk/latest/guide/use_cfn_template.html#use_cfn_template_install) module.

  <details>
    <summary>Example 1) CloudFormation template with suppression</summary>

  Sample CloudFormation template with suppression

  ```json
  {
    "Resources": {
      "rBucket": {
        "Type": "AWS::S3::Bucket",
        "Properties": {
          "BucketName": "some-bucket-name"
        },
        "Metadata": {
          "cdk_nag": {
            "rules_to_suppress": [
              {
                "id": "AwsSolutions-S1",
                "reason": "at least 10 characters"
              }
            ]
          }
        }
      }
    }
  }
  ```

  Sample App

  ```python
  import { App, Aspects } from 'aws-cdk-lib';
  import { CdkTestStack } from '../lib/cdk-test-stack';
  import { AwsSolutionsChecks } from 'cdk-nag';

  const app = new App();
  new CdkTestStack(app, 'CdkNagDemo');
  Aspects.of(app).add(new AwsSolutionsChecks());
  ```

  Sample Stack with imported template

  ```python
  import { CfnInclude } from 'aws-cdk-lib/cloudformation-include';
  import { NagSuppressions } from 'cdk-nag';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      new CfnInclude(this, 'Template', {
        templateFile: 'my-template.json',
      });
      // Add any additional suppressions
      NagSuppressions.addResourceSuppressionsByPath(
        this,
        '/CdkNagDemo/Template/rBucket',
        [
          {
            id: 'AwsSolutions-S2',
            reason: 'at least 10 characters',
          },
        ]
      );
    }
  }
  ```

  </details><details>
    <summary>Example 2) CloudFormation template with granular suppressions</summary>

  Sample CloudFormation template with suppression

  ```json
  {
    "Resources": {
      "myPolicy": {
        "Type": "AWS::IAM::Policy",
        "Properties": {
          "PolicyDocument": {
            "Statement": [
              {
                "Action": [
                  "kms:Decrypt",
                  "kms:DescribeKey",
                  "kms:Encrypt",
                  "kms:ReEncrypt*",
                  "kms:GenerateDataKey*"
                ],
                "Effect": "Allow",
                "Resource": ["some-key-arn"]
              }
            ],
            "Version": "2012-10-17"
          }
        },
        "Metadata": {
          "cdk_nag": {
            "rules_to_suppress": [
              {
                "id": "AwsSolutions-IAM5",
                "reason": "Allow key data access",
                "applies_to": [
                  "Action::kms:ReEncrypt*",
                  "Action::kms:GenerateDataKey*"
                ]
              }
            ]
          }
        }
      }
    }
  }
  ```

  Sample App

  ```python
  import { App, Aspects } from 'aws-cdk-lib';
  import { CdkTestStack } from '../lib/cdk-test-stack';
  import { AwsSolutionsChecks } from 'cdk-nag';

  const app = new App();
  new CdkTestStack(app, 'CdkNagDemo');
  Aspects.of(app).add(new AwsSolutionsChecks());
  ```

  Sample Stack with imported template

  ```python
  import { CfnInclude } from 'aws-cdk-lib/cloudformation-include';
  import { NagSuppressions } from 'cdk-nag';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
      new CfnInclude(this, 'Template', {
        templateFile: 'my-template.json',
      });
      // Add any additional suppressions
      NagSuppressions.addResourceSuppressionsByPath(
        this,
        '/CdkNagDemo/Template/myPolicy',
        [
          {
            id: 'AwsSolutions-IAM5',
            reason: 'Allow key data access',
            appliesTo: ['Action::kms:ReEncrypt*', 'Action::kms:GenerateDataKey*'],
          },
        ]
      );
    }
  }
  ```

  </details>



  See [CONTRIBUTING](./CONTRIBUTING.md) for more information.



  This project is licensed under the Apache-2.0 License.


pkgId: 85f2d7b2bcd2b634eb99d6f73a787feb92ddbf38d812d50f1af4f7871d31a8ac
name: python-cdk-opinionated-constructs
arch: src
version: 3.11.1
epoch: 0
release: 1
summary: AWS CDK constructs come without added security configurations.
url: https://pypi.org/project/cdk-opinionated-constructs/
rpm_license: MIT
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-opinionated-constructs-3.11.1-1.src.rpm
checksum_type: sha256
description:
  The idea behind this project is to create secured constructs from the start.
  Supported constructs: ALB, ECR, LMB, NLB, S3, SNS, WAF, RDS


pkgId: 3844ff283464348a3236390e4aca03df9d714885628b60110f132821cf0408bb
name: python-cdk-organizations-list-accounts
arch: src
version: 1.0.356
epoch: 0
release: 1
url: https://github.com/hayao-k/cdk-organizations-list-accounts.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-organizations-list-accounts-1.0.356-1.src.rpm
checksum_type: sha256
summary:
  cdk-organizations-list-accounts is an AWS CDK building library that outputs a list of AWS organization accounts in CSV format.

description:
  [![NPM version](https://badge.fury.io/js/cdk-organizations-list-accounts.svg)](https://badge.fury.io/js/cdk-organizations-list-accounts)
  [![PyPI version](https://badge.fury.io/py/cdk-organizations-list-accounts.svg)](https://badge.fury.io/py/cdk-organizations-list-accounts)
  ![Release](https://github.com/hayao-k/cdk-organizations-list-accounts/workflows/release/badge.svg)



  Want to keep an up-to-date list of your AWS accounts?

  cdk-organizations-list-accounts is an AWS CDK building library that outputs a list of AWS organization accounts in CSV format.



  Amazon EventBridge detects the account creation event and starts a Lambda function.
  An accounts list, including the organization structure, will be output to S3 bucket in CSV format.

  Output Example:

  ```csv
  Id,Name,Email,Status,Joined Method,Joined Timestamp,OU Id,1st Level OU,2nd Level OU,3rd Level OU,4th Level OU,5th Level OU
  000000000000,account-mgmt,account+mgmt@example.com,ACTIVE,INVITED,2022-01-31 07:19:57,r-xxxx
  111111111111,account-0001,account+0001@example.com,ACTIVE,INVITED,2022-01-31 07:25:38,ou-xxxx-yyyyyyyy,Suspended
  222222222222,account-0002,account+0002@example.com,ACTIVE,CREATED,2022-01-31 07:31:28,ou-xxxx-zzzzzzzz,Sample System,Additional,Workloads,Prod
  333333333333,account-0003,account+0003@example.com,ACTIVE,CREATED,2022-01-31 08:15:49,ou-xxxx-zzzzzzzz,Sample System,Additional,Workloads,SDLC
  444444444444,account-0004,account+0004@example.com,ACTIVE,CREATED,2022-01-31 09:18:50,ou-xxxx-zzzzzzzz,Sample System,Foundational,Security,Prod
  555555555555,account-0005,account+0005@example.com,ACTIVE,CREATED,2022-01-31 10:21:30,ou-xxxx-zzzzzzzz,Sample System,Foundational,Infrastructure,Prod
  666666666666,account-0006,account+0006@example.com,ACTIVE,CREATED,2022-01-31 11:21:05,ou-xxxx-zzzzzzzz,Sample System,Foundational,Infrastructure,SDLC
  ```



  * Must deploy to AWS Organization's management account
  * Events other than CreateAccount are not supported





  Installation

  ```
  $ yarn add cdk-organizations-list-accounts
  ```

  Usage

  ```python
  import * as cdk from 'aws-cdk-lib';
  import { OrganizationsListAccounts } from 'cdk-organizations-list-accounts';

  const App = new cdk.App();
  const stack = new cdk.Stack(App, 'Stack', { env: { region: 'us-east-1' } });
  new OrganizationsListAccounts(stack, 'Organizations-List-Accounts');
  ```

  Deploy!

  ```
  $ cdk deploy
  ```



  Installation

  ```
  $ pip install cdk-organizations-list-accounts
  ```

  Usage

  ```py
  import aws_cdk as cdk
  from cdk_organizations_list_accounts import OrganizationsListAccounts

  app = cdk.App()
  stack = cdk.Stack(app, "Stack", env={"region": "us-east-1"})
  OrganizationsListAccounts(stack, "Organizations-List-Accounts")
  app.synth()
  ```

  Deploy!

  ```
  $ cdk deploy
  ```


pkgId: e2f9e5d17e9e17971b20136a56c502a6ee301a4301b8e2a86249733af41a2400
name: python-cdk-pipelines-github
arch: src
version: 0.4.126
epoch: 0
release: 1
summary: GitHub Workflows support for CDK Pipelines
url: https://github.com/cdklabs/cdk-pipelines-github.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-pipelines-github-0.4.126-1.src.rpm
checksum_type: sha256
description:
  ![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)

  [![View on Construct Hub](https://constructs.dev/badge?package=cdk-pipelines-github)](https://constructs.dev/packages/cdk-pipelines-github)

  > The APIs in this module are experimental and under active development.
  > They are subject to non-backward compatible changes or removal in any future version. These are
  > not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be
  > announced in the release notes. This means that while you may use them, you may need to update
  > your source code when upgrading to a newer version of this package.

  A construct library for painless Continuous Delivery of CDK applications,
  deployed via
  [GitHub Workflows](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions).

  The CDK already has a CI/CD solution,
  [CDK Pipelines](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.pipelines-readme.html),
  which creates an AWS CodePipeline that deploys CDK applications. This module
  serves the same surface area, except that it is implemented with GitHub
  Workflows.



  * [CDK Pipelines for GitHub Workflows](#cdk-pipelines-for-github-workflows)

    * [Table of Contents](#table-of-contents)
    * [Usage](#usage)
    * [Initial Setup](#initial-setup)
    * [AWS Credentials](#aws-credentials)

      * [GitHub Action Role](#github-action-role)

        * [`GitHubActionRole` Construct](#githubactionrole-construct)
      * [GitHub Secrets](#github-secrets)
      * [Runners with Preconfigured Credentials](#runners-with-preconfigured-credentials)
      * [Using Docker in the Pipeline](#using-docker-in-the-pipeline)

        * [Authenticating to Docker registries](#authenticating-to-docker-registries)
    * [Runner Types](#runner-types)

      * [GitHub Hosted Runner](#github-hosted-runner)
      * [Self Hosted Runner](#self-hosted-runner)
    * [Escape Hatches](#escape-hatches)
    * [Additional Features](#additional-features)

      * [GitHub Action Step](#github-action-step)
      * [Configure GitHub Environment](#configure-github-environment)

        * [Waves for Parallel Builds](#waves-for-parallel-builds)
        * [Manual Approval Step](#manual-approval-step)
      * [Pipeline YAML Comments](#pipeline-yaml-comments)
      * [Common Configuration for Docker Asset Publishing Steps](#common-configuration-for-docker-asset-publishing-steps)
      * [Workflow Concurrency](#workflow-concurrency)
    * [AWS China partition support](#aws-china-partition-support)
    * [Tutorial](#tutorial)
    * [Not supported yet](#not-supported-yet)
    * [Contributing](#contributing)
    * [License](#license)



  Assuming you have a
  [`Stage`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.Stage.html)
  called `MyStage` that includes CDK stacks for your app and you want to deploy it
  to two AWS environments (`BETA_ENV` and `PROD_ENV`):

  ```python
  from aws_cdk.pipelines import ShellStep


  app = App()

  pipeline = GitHubWorkflow(app, "Pipeline",
      synth=ShellStep("Build",
          commands=["yarn install", "yarn build"
          ]
      ),
      aws_creds=AwsCredentials.from_open_id_connect(
          git_hub_action_role_arn="arn:aws:iam::<account-id>:role/GitHubActionRole"
      )
  )


  beta_stage = MyStage(app, "Beta", env=BETA_ENV)
  prod_stage = MyStage(app, "Prod", env=PROD_ENV)


  pipeline.add_stage(beta_stage)
  pipeline.add_stage(prod_stage)


  wave = pipeline.add_wave("Wave")
  wave.add_stage(beta_stage)
  wave.add_stage(prod_stage)

  app.synth()
  ```

  When you run `cdk synth`, a `deploy.yml` workflow will be created under
  `.github/workflows` in your repo. This workflow will deploy your application
  based on the definition of the pipeline. In the example above, it will deploy
  the two stages in sequence, and within each stage, it will deploy all the
  stacks according to their dependency order and maximum parallelism. If your app
  uses assets, assets will be published to the relevant destination environment.

  The `Pipeline` class from `cdk-pipelines-github` is derived from the base CDK
  Pipelines class, so most features should be supported out of the box. See the
  [CDK Pipelines](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.pipelines-readme.html)
  documentation for more details.

  To express GitHub-specifc details, such as those outlined in [Additional Features](#additional-features), you have a few options:

  * Use a `GitHubStage` instead of `Stage` (or make a `GitHubStage` subclass instead of a `Stage` subclass) - this adds the `GitHubCommonProps` to the `Stage` properties

    * With this you can use `pipeline.addStage(myGitHubStage)` or `wave.addStage(myGitHubStage)` and the properties of the
      stage will be used
  * Using a `Stage` (or subclass thereof) or a `GitHubStage` (or subclass thereof) you can call `pipeline.addStageWithGitHubOptions(stage, stageOptions)` or `wave.addStageWithGitHubOptions(stage, stageOptions)`

    * In this case you're providing the same options along with the stage instead of embedded in the stage.
    * Note that properties of a `GitHubStage` added with `addStageWithGitHubOptions()` will override the options provided to `addStageWithGitHubOptions()`

  **NOTES:**

  * Environments must be bootstrapped separately using `cdk bootstrap`. See [CDK
    Environment
    Bootstrapping](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.pipelines-readme.html#cdk-environment-bootstrapping)
    for details.



  Assuming you have your CDK app checked out on your local machine, here are the suggested steps
  to develop your GitHub Workflow.

  * Set up AWS Credentials your local environment. It is highly recommended to authenticate via an OpenId
    Connect IAM Role. You can set one up using the [`GithubActionRole`](#github-action-role) class provided
    in this module. For more information (and alternatives), see [AWS Credentials](#aws-credentials).
  * When you've updated your pipeline and are ready to deploy, run `cdk synth`. This creates a workflow file
    in `.github/workflows/deploy.yml`.
  * When you are ready to test your pipeline, commit your code changes as well as the `deploy.yml` file to
    GitHub. GitHub will automatically try to run the workflow found under `.github/workflows/deploy.yml`.
  * You will be able to see the result of the run on the `Actions` tab in your repository:

    ![Screen Shot 2021-08-22 at 12 06 05](https://user-images.githubusercontent.com/598796/130349345-a10a2f75-0848-4de8-bc4c-f5a1418ee228.png)

  For an in-depth run-through on creating your own GitHub Workflow, see the
  [Tutorial](#tutorial) section.



  There are two ways to supply AWS credentials to the workflow:

  * GitHub Action IAM Role (recommended).
  * Long-lived AWS Credentials stored in GitHub Secrets.

  The GitHub Action IAM Role authenticates via the GitHub OpenID Connect provider
  and is recommended, but it requires preparing your AWS account beforehand. This
  approach allows your Workflow to exchange short-lived tokens directly from AWS.
  With OIDC, benefits include:

  * No cloud secrets.
  * Authentication and authorization management.
  * Rotating credentials.

  You can read more
  [here](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect).



  Authenticating via OpenId Connect means you do not need to store long-lived
  credentials as GitHub Secrets. With OIDC, you provide a pre-provisioned IAM
  role with optional role session name to your GitHub Workflow via the `awsCreds.fromOpenIdConnect` API:

  ```python
  from aws_cdk.pipelines import ShellStep


  app = App()

  pipeline = GitHubWorkflow(app, "Pipeline",
      synth=ShellStep("Build",
          commands=["yarn install", "yarn build"
          ]
      ),
      aws_creds=AwsCredentials.from_open_id_connect(
          git_hub_action_role_arn="arn:aws:iam::<account-id>:role/GitHubActionRole",
          role_session_name="optional-role-session-name"
      )
  )
  ```

  There are two ways to create this IAM role:

  * Use the `GitHubActionRole` construct (recommended and described below).
  * Manually set up the role ([Guide](https://github.com/cdklabs/cdk-pipelines-github/blob/main/GITHUB_ACTION_ROLE_SETUP.md)).



  Because this construct involves creating an IAM role in your account, it must
  be created separate to your GitHub Workflow and deployed via a normal
  `cdk deploy` with your local AWS credentials. Upon successful deployment, the
  arn of your newly created IAM role will be exposed as a `CfnOutput`.

  To utilize this construct, create a separate CDK stack with the following code
  and `cdk deploy`:

  ```python
  class MyGitHubActionRole(Stack):
      def __init__(self, scope, id, *, description=None, env=None, stackName=None, tags=None, synthesizer=None, terminationProtection=None, analyticsReporting=None, crossRegionReferences=None, permissionsBoundary=None):
          super().__init__(scope, id, description=description, env=env, stackName=stackName, tags=tags, synthesizer=synthesizer, terminationProtection=terminationProtection, analyticsReporting=analyticsReporting, crossRegionReferences=crossRegionReferences, permissionsBoundary=permissionsBoundary)

          provider = GitHubActionRole(self, "github-action-role",
              repos=["myUser/myRepo"]
          )

  app = App()
  MyGitHubActionRole(app, "MyGitHubActionRole")
  app.synth()
  ```

  Specifying a `repos` array grants GitHub full access to the specified repositories.
  To restrict access to specific git branch, tag, or other
  [GitHub OIDC subject claim](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#example-subject-claims),
  specify a `subjectClaims` array instead of a `repos` array.

  ```python
  class MyGitHubActionRole(Stack):
      def __init__(self, scope, id, *, description=None, env=None, stackName=None, tags=None, synthesizer=None, terminationProtection=None, analyticsReporting=None, crossRegionReferences=None, permissionsBoundary=None):
          super().__init__(scope, id, description=description, env=env, stackName=stackName, tags=tags, synthesizer=synthesizer, terminationProtection=terminationProtection, analyticsReporting=analyticsReporting, crossRegionReferences=crossRegionReferences, permissionsBoundary=permissionsBoundary)

          provider = GitHubActionRole(self, "github-action-role",
              subject_claims=["repo:owner/repo1:ref:refs/heads/main", "repo:owner/repo1:environment:prod"
              ]
          )

  app = App()
  MyGitHubActionRole(app, "MyGitHubActionRole")
  app.synth()
  ```

  Note: If you have previously created the GitHub identity provider with url
  `https://token.actions.githubusercontent.com`, the above example will fail
  because you can only have one such provider defined per account. In this
  case, you must provide the already created provider into your `GithubActionRole`
  construct via the `provider` property.

  > Make sure the audience for the provider is `sts.amazonaws.com` in this case.

  ```python
  class MyGitHubActionRole(Stack):
      def __init__(self, scope, id, *, description=None, env=None, stackName=None, tags=None, synthesizer=None, terminationProtection=None, analyticsReporting=None, crossRegionReferences=None, permissionsBoundary=None):
          super().__init__(scope, id, description=description, env=env, stackName=stackName, tags=tags, synthesizer=synthesizer, terminationProtection=terminationProtection, analyticsReporting=analyticsReporting, crossRegionReferences=crossRegionReferences, permissionsBoundary=permissionsBoundary)

          provider = GitHubActionRole(self, "github-action-role",
              repos=["myUser/myRepo"],
              provider=GitHubActionRole.existing_git_hub_actions_provider(self)
          )
  ```



  Authenticating via this approach means that you will be manually creating AWS
  credentials and duplicating them in GitHub secrets. The workflow expects the
  GitHub repository to include secrets with AWS credentials under
  `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`. You can override these defaults
  by supplying the `awsCreds.fromGitHubSecrets` API to the workflow:

  ```python
  from aws_cdk.pipelines import ShellStep


  app = App()

  pipeline = GitHubWorkflow(app, "Pipeline",
      synth=ShellStep("Build",
          commands=["yarn install", "yarn build"
          ]
      ),
      aws_creds=AwsCredentials.from_git_hub_secrets(
          access_key_id="MY_ID",  # GitHub will look for the access key id under the secret `MY_ID`
          secret_access_key="MY_KEY"
      )
  )
  ```



  If your runners provide credentials themselves, you can configure `awsCreds` to
  skip passing credentials:

  ```python
  from aws_cdk.pipelines import ShellStep


  app = App()

  pipeline = GitHubWorkflow(app, "Pipeline",
      synth=ShellStep("Build",
          commands=["yarn install", "yarn build"
          ]
      ),
      aws_creds=AwsCredentials.runner_has_preconfigured_creds()
  )
  ```



  You can use Docker in GitHub Workflows in a similar fashion to CDK Pipelines.
  For a full discussion on how to use Docker in CDK Pipelines, see
  [Using Docker in the Pipeline](https://github.com/aws/aws-cdk/blob/master/packages/@aws-cdk/pipelines/README.md#using-docker-in-the-pipeline).

  Just like CDK Pipelines, you may need to authenticate to Docker registries to
  avoid being throttled.



  You can specify credentials to use for authenticating to Docker registries as
  part of the Workflow definition. This can be useful if any Docker image assets —
  in the pipeline or any of the application stages — require authentication, either
  due to being in a different environment (e.g., ECR repo) or to avoid throttling
  (e.g., DockerHub).

  ```python
  from aws_cdk.pipelines import ShellStep


  app = App()

  pipeline = GitHubWorkflow(app, "Pipeline",
      synth=ShellStep("Build",
          commands=["yarn install", "yarn build"
          ]
      ),
      docker_credentials=[
          
          DockerCredential.ecr("<account-id>.dkr.ecr.<aws-region>.amazonaws.com"),

          
          DockerCredential.ghcr(),

          
          DockerCredential.docker_hub(
              
              username_key="DOCKERHUB_USERNAME",
              personal_access_token_key="DOCKERHUB_TOKEN"
          ),

          
          DockerCredential.custom_registry("custom-registry",
              username_key="CUSTOM_USERNAME",
              password_key="CUSTOM_PASSWORD"
          )
      ]
  )
  ```



  You can choose to run the workflow in either a GitHub hosted or [self-hosted](https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners) runner.



  The default is `Runner.UBUNTU_LATEST`. You can override this as shown below:

  ```python
  from aws_cdk.pipelines import ShellStep


  app = App()

  pipeline = GitHubWorkflow(app, "Pipeline",
      synth=ShellStep("Build",
          commands=["yarn install", "yarn build"
          ]
      ),
      runner=Runner.WINDOWS_LATEST
  )
  ```



  The following example shows how to configure the workflow to run on a self-hosted runner. Note that you do not need to pass in `self-hosted` explicitly as a label.

  ```python
  from aws_cdk.pipelines import ShellStep


  app = App()

  pipeline = GitHubWorkflow(app, "Pipeline",
      synth=ShellStep("Build",
          commands=["yarn install", "yarn build"
          ]
      ),
      runner=Runner.self_hosted(["label1", "label2"])
  )
  ```



  You can override the `deploy.yml` workflow file post-synthesis however you like.

  ```python
  from aws_cdk.pipelines import ShellStep


  app = App()

  pipeline = GitHubWorkflow(app, "Pipeline",
      synth=ShellStep("Build",
          commands=["yarn install", "yarn build"
          ]
      )
  )

  deploy_workflow = pipeline.workflow_file

  deploy_workflow.patch(JsonPatch.add("/on/workflow_call", {}))

  deploy_workflow.patch(JsonPatch.remove("/on/workflow_dispatch"))
  ```



  Below is a compilation of additional features available for GitHub Workflows.



  If you want to call a GitHub Action in a step, you can utilize the `GitHubActionStep`.
  `GitHubActionStep` extends `Step` and can be used anywhere a `Step` type is allowed.

  The `jobSteps` array is placed into the pipeline job at the relevant `jobs.<job_id>.steps` as [documented here](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idsteps).

  GitHub Actions Job permissions can be modified by passing the `permissions` object to `GitHubActionStep`.
  The default set of permissions is simply `contents: write`.

  In this example,

  ```python
  from aws_cdk.pipelines import ShellStep


  app = App()

  pipeline = GitHubWorkflow(app, "Pipeline",
      synth=ShellStep("Build",
          commands=["yarn install", "yarn build"
          ]
      )
  )


  stage = MyStage(app, "Beta", env=BETA_ENV)
  pipeline.add_stage(stage,
      pre=[GitHubActionStep("PreBetaDeployAction",
          permissions=JobPermissions(
              id_token=JobPermission.WRITE,
              contents=JobPermission.WRITE
          ),
          job_steps=[JobStep(
              name="Checkout",
              uses="actions/checkout@v4"
          ), JobStep(
              name="pre beta-deploy action",
              uses="my-pre-deploy-action@1.0.0"
          ), JobStep(
              name="pre beta-deploy check",
              run="npm run preDeployCheck"
          )
          ]
      )]
  )

  app.synth()
  ```



  You can run your GitHub Workflow in select
  [GitHub Environments](https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment).
  Via the GitHub UI, you can configure environments with protection rules and secrets, and reference
  those environments in your CDK app. A workflow that references an environment must follow any
  protection rules for the environment before running or accessing the environment's secrets.

  Assuming (just like in the main [example](#usage)) you have a
  [`Stage`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.Stage.html)
  called `MyStage` that includes CDK stacks for your app and you want to deploy it
  to two AWS environments (`BETA_ENV` and `PROD_ENV`) as well as GitHub Environments
  `beta` and `prod`:

  ```python
  from aws_cdk.pipelines import ShellStep


  app = App()

  pipeline = GitHubWorkflow(app, "Pipeline",
      synth=ShellStep("Build",
          commands=["yarn install", "yarn build"
          ]
      ),
      aws_creds=AwsCredentials.from_open_id_connect(
          git_hub_action_role_arn="arn:aws:iam::<account-id>:role/GitHubActionRole"
      )
  )

  pipeline.add_stage_with_git_hub_options(Stage(self, "Beta",
      env=BETA_ENV
  ),
      git_hub_environment=GitHubEnvironment(name="beta")
  )
  pipeline.add_stage_with_git_hub_options(MyStage(self, "Prod",
      env=PROD_ENV
  ),
      git_hub_environment=GitHubEnvironment(name="prod")
  )

  app.synth()
  ```



  You can add a Wave to a pipeline, where each stage of a wave will build in parallel.

  > **Note**: The `pipeline.addWave()` call will return a `Wave` object that is actually a `GitHubWave` object, but
  > due to JSII rules the return type of `addWave()` cannot be changed. If you need to use
  > `wave.addStageWithGitHubOptions()` then you should call `pipeline.addGitHubWave()` instead, or you can
  > use `GitHubStage`s to carry the GitHub properties.

  When deploying to multiple accounts or otherwise deploying mostly-unrelated stacks, using waves can be a huge win.

  Here's a relatively large (but real) example, **without** a wave:

  <img width="1955" alt="without-waves-light-mode" src="https://user-images.githubusercontent.com/386001/217436992-d8e46c23-6295-48ec-b139-add60b1f5a14.png">

  You can see how dependencies get chained unnecessarily, where the `cUrl` step should be the final step (a test) for an account:

  <img width="1955" alt="without-waves-deps-light-mode" src="https://user-images.githubusercontent.com/386001/217437074-3c86d88e-6be7-4b10-97b1-6b51b100e4d6.png">

  Here's the exact same stages deploying the same stacks to the same accounts, but **with** a wave:

  <img width="1955" alt="with-waves" src="https://user-images.githubusercontent.com/386001/217437228-72f6c278-7e97-4a88-91fa-089628ea0381.png">

  And the dependency chains are reduced to only what is actually needed, with the `cUrl` calls as the final stage for each account:

  <img width="1955" alt="deps" src="https://user-images.githubusercontent.com/386001/217437265-1c10cd5f-3c7d-4e3a-af5c-acbdf3acff1b.png">

  For additional information and a code example see [here](docs/waves.md).



  One use case for using GitHub Environments with your CDK Pipeline is to create a
  manual approval step for specific environments via Environment protection rules.
  From the GitHub UI, you can specify up to 5 required reviewers that must approve
  before the deployment can proceed:

  <img width="1134" alt="require-reviewers" src="https://user-images.githubusercontent.com/7248260/163494925-627f5ca7-a34e-48fa-bec7-1e4924ab6c0c.png">

  For more information and a tutorial for how to set this up, see this
  [discussion](https://github.com/cdklabs/cdk-pipelines-github/issues/162).



  An "AUTOMATICALLY GENERATED FILE..." comment will by default be added to the top
  of the pipeline YAML. This can be overriden as desired to add additional context
  to the pipeline YAML.

  ```yaml
  declare const pipeline: GitHubWorkflow;

  pipeline.workflowFile.commentAtTop = `AUTOGENERATED FILE, DO NOT EDIT DIRECTLY!

  Deployed stacks from this pipeline:
  ${STACK_NAMES.map((s)=>`- ${s}\n`)}`;
  ```

  This will generate the normal `deploy.yml` file, but with the additional comments:

  ```yaml






  name: deploy
  on:
    push:
      branches:
  < the rest of the pipeline YAML contents>
  ```



  You can provide common job configuration for all of the docker asset publishing
  jobs using the `dockerAssetJobSettings` property. You can use this to:

  * Set additional `permissions` at the job level
  * Run additional steps prior to the docker build/push step

  Below is an example of example of configuration an additional `permission` which
  allows the job to authenticate against GitHub packages. It also shows
  configuration additional `setupSteps`, in this case setup steps to configure
  docker `buildx` and `QEMU` to enable building images for arm64 architecture.

  ```python
  from aws_cdk.pipelines import ShellStep


  app = App()

  pipeline = GitHubWorkflow(app, "Pipeline",
      synth=ShellStep("Build",
          commands=["yarn install", "yarn build"
          ]
      ),
      docker_asset_job_settings=DockerAssetJobSettings(
          permissions=JobPermissions(
              packages=JobPermission.READ
          ),
          setup_steps=[JobStep(
              name="Setup Docker QEMU",
              uses="docker/setup-qemu-action@v3"
          ), JobStep(
              name="Setup Docker buildx",
              uses="docker/setup-buildx-action@v3"
          )
          ]
      ),
      aws_creds=AwsCredentials.from_open_id_connect(
          git_hub_action_role_arn="arn:aws:iam::<account-id>:role/GitHubActionRole"
      )
  )

  app.synth()
  ```



  If you want to prevent your workflow from running in parallel you can specify the concurrency at workflow level.
  Below is an example of a workflow that will not run in parallel and where a running workflow will be cancelled in favor of the more recent one.
  The [GitHub docs](https://docs.github.com/en/actions/using-jobs/using-concurrency) provide further details on this.

  ```python
  from aws_cdk.pipelines import ShellStep


  app = App()

  pipeline = GitHubWorkflow(app, "SequentialPipeline",
      concurrency=ConcurrencyOptions(
          group="${{ github.workflow }}-group",
          cancel_in_progress=True
      ),
      synth=ShellStep("Build",
          commands=["yarn install", "yarn build"
          ]
      ),
      aws_creds=AwsCredentials.from_open_id_connect(
          git_hub_action_role_arn="arn:aws:iam::<account-id>:role/GitHubActionRole"
      )
  )
  ```



  The `CDK_AWS_PARTITION` environment variable can be used to specify the AWS partition for the pipeline.
  If it's specified to `aws-cn`, the assets generated by pipeline will reference the resources in
  `.amazonaws.com.cn` instead of `.amazonaws.com`.

  If `CDK_AWS_PARTITION` environment variable is not specified, the default behaviour for the pipeline is
  to use the `aws` partition.

  It is not possible to have a pipeline that deploys to both `aws` and `aws-cn` partitions.
  If you need to deploy to both partitions, you will need to create two separate pipelines.
  The stages and stacks can be shared between the two pipelines.



  You can find an example usage in [test/example-app.ts](./test/example-app.ts)
  which includes a simple CDK app and a pipeline.

  You can find a repository that uses this example here: [eladb/test-app-cdkpipeline](https://github.com/eladb/test-app-cdkpipeline).

  To run the example, clone this repository and install dependencies:

  ```shell
  cd ~/projects # or some other playground space
  git clone https://github.com/cdklabs/cdk-pipelines-github
  cd cdk-pipelines-github
  yarn
  ```

  Now, create a new GitHub repository and clone it as well:

  ```shell
  cd ~/projects
  git clone https://github.com/myaccount/my-test-repository
  ```

  You'll need to set up AWS credentials in your environment. Note that this tutorial uses
  long-lived GitHub secrets as credentials for simplicity, but it is recommended to set up
  a GitHub OIDC role instead.

  ```shell
  export AWS_ACCESS_KEY_ID=xxxx
  export AWS_SECRET_ACCESS_KEY=xxxxx
  ```

  Bootstrap your environments:

  ```shell
  export CDK_NEW_BOOTSTRAP=1
  npx cdk bootstrap aws://ACCOUNTID/us-east-1
  npx cdk bootstrap aws://ACCOUNTID/eu-west-2
  ```

  Now, run the `manual-test.sh` script when your working directory is the new repository:

  ```shell
  cd ~/projects/my-test-repository
  ~/projects/cdk-piplines/github/test/manual-test.sh
  ```

  This will produce a `cdk.out` directory and a `.github/workflows/deploy.yml` file.

  Commit and push these files to your repo and you should see the deployment
  workflow in action. Make sure your GitHub repository has `AWS_ACCESS_KEY_ID` and
  `AWS_SECRET_ACCESS_KEY` secrets that can access the same account that you
  synthesized against.

  > In this tutorial, you are supposed to commit `cdk.out` (i.e. the code is pre-synthed).
  > Do not do this in your app; you should always synth during the synth step of the GitHub
  > workflow. In the example app this is achieved through the `preSynthed: true` option.
  > It is for example purposes only and is not something you should do in your app.
  >
  > ```python
  > from aws_cdk.pipelines import ShellStep
  >
  > pipeline = GitHubWorkflow(App(), "Pipeline",
  >     synth=ShellStep("Build",
  >         commands=["echo \"nothing to do (cdk.out is committed)\""]
  >     ),
  >     # only the example app should do this. your app should synth in the synth step.
  >     pre_synthed=True
  > )
  > ```



  Most features that exist in CDK Pipelines are supported. However, as the CDK Pipelines
  feature are expands, the feature set for GitHub Workflows may lag behind. If you see a
  feature that you feel should be supported by GitHub Workflows, please open a GitHub issue
  to track it.



  See [CONTRIBUTING](CONTRIBUTING.md) for more information.



  This project is licensed under the Apache-2.0 License.


pkgId: 408a4195bd75fbd9394cb8125d7566ba77eb65f1c8107324cd44c05481e5aae9
name: python-cdk-preinstalled-amazon-linux-ec2
arch: src
version: 0.0.11
epoch: 0
release: 1
summary: CDK Construct for creating an Amazon Linux EC2 instance with pre-installed software
url: https://github.com/badmintoncryer/cdk-preinstalled-amazon-linux-ec2.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-preinstalled-amazon-linux-ec2-0.0.11-1.src.rpm
checksum_type: sha256
description:
  This is a CDK Construct for creating a preinstalled AmazonLinux EC2 instance.

  You can use Node.js, Visual Studio Code, git and other software as soon as the EC2 instance starts.

  [![View on Construct Hub](https://constructs.dev/badge?package=cdk-preinstalled-amazon-linux-ec2)](https://constructs.dev/packages/cdk-preinstalled-amazon-linux-ec2)

  [![Open in Visual Studio Code](https://img.shields.io/static/v1?logo=visualstudiocode&label=&message=Open%20in%20Visual%20Studio%20Code&labelColor=2c2c32&color=007acc&logoColor=007acc)](https://open.vscode.dev/badmintoncryer/cdk-preinstalled-amazon-linux-ec2)
  [![npm version](https://badge.fury.io/js/cdk-preinstalled-amazon-linux-ec2.svg)](https://badge.fury.io/js/cdk-preinstalled-amazon-linux-ec2)
  [![Build Status](https://github.com/badmintoncryer/cdk-preinstalled-amazon-linux-ec2/actions/workflows/build.yml/badge.svg)](https://github.com/badmintoncryer/cdk-preinstalled-amazon-linux-ec2/actions/workflows/build.yml)
  [![Release Status](https://github.com/badmintoncryer/cdk-preinstalled-amazon-linux-ec2/actions/workflows/release.yml/badge.svg)](https://github.com/badmintoncryer/cdk-preinstalled-amazon-linux-ec2/actions/workflows/release.yml)
  [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
  [![npm downloads](https://img.shields.io/npm/dm/cdk-preinstalled-amazon-linux-ec2.svg?style=flat)](https://www.npmjs.com/package/cdk-preinstalled-amazon-linux-ec2)



  Install the package:

  ```bash
  npm install cdk-preinstalled-amazon-linux-ec2
  ```

  Use it in your CDK stack:

  ```python
  import { PreinstalledAmazonLinuxInstance } from 'cdk-preinstalled-amazon-linux-ec2';
  import * as ec2 from 'aws-cdk-lib/aws-ec2';

  declare const vpc: ec2.IVpc;

  // You can configure all properties of the EC2 instance
  new PreinstalledAmazonLinuxInstance(this, 'Instance', {
    vpc,
    instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.NANO),
    machineImage: new ec2.AmazonLinuxImage({
      generation: ec2.AmazonLinuxGeneration.AMAZON_LINUX_2023,
    }),
    // Specify preinstalled software
    preinstalledSoftware: {
      packages: [
        PreinstalledSoftwareType.NODEJS,
        PreinstalledSoftwareType.VSCODE,
        PreinstalledSoftwareType.GIT,
      ],
      others: ['rsyslog'], // You can specify other software packages. These parameters are used as `sudo dnf install ${parameter}`
  });
  ```

  After the stack is deployed, you can SSH into the EC2 instance and use Node.js:

  ```bash
  $ ssh ec2-user@<public-ip>
  $ node --version
  v20.13.1
  $ code --version
  1.89.1
  $ git --version
  git version 2.39.3
  ```



  Installation of software is done by user data script. You can see the script in the `src/index.ts` file.

  ```python
  // Install Node.js
  userData.addCommands(
    'touch ~/.bashrc',
    'curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash',
    'source ~/.bashrc',
    'export NVM_DIR="$HOME/.nvm"',
    '[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"',
    `nvm install ${props.nodeJsVersion ?? '--lts'}`,
    // Note that the above will install nvm, node and npm for the root user.
    // It will not add the correct ENV VAR in ec2-user's environment.
    `cat <<EOF >> /home/ec2-user/.bashrc
  export NVM_DIR="/.nvm"
  [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
  EOF`);
  ```

  Ofcourse, you can customize the additional user data script by calling `instance.userData.addCommands()` method.

  ```python
  declare const instance: PreinstalledAmazonLinuxInstance;

  // install yarn
  instance.userData.addCommands(
    'npm install -g yarn'
  );
  ```


pkgId: 75d97b94ea949d64c1549638ed4c92fd554d4f05916c82b298e22394d1a72664
name: python-cdk-private-asset-bucket
arch: src
version: 2.25.0
epoch: 0
release: 1
url: https://github.com/mmuller88/cdk-private-asset-bucket
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-private-asset-bucket-2.25.0-1.src.rpm
checksum_type: sha256
summary:
  Construct to create a private asset S3 bucket. A cognito token can be used to allow access to he S3 asset.

description:
  [![NPM version](https://badge.fury.io/js/cdk-private-asset-bucket.svg)](https://badge.fury.io/js/cdk-private-asset-bucket)
  [![PyPI version](https://badge.fury.io/py/cdk-private-asset-bucket.svg)](https://badge.fury.io/py/cdk-private-asset-bucket)
  [![.NET version](https://img.shields.io/nuget/v/com.github.mmuller88.cdkPrivateAssetBucket.svg?style=flat-square)](https://www.nuget.org/packages/com.github.mmuller88.cdkPrivateAssetBucket/)
  ![Release](https://github.com/mmuller88/cdk-private-asset-bucket/workflows/Release/badge.svg)



  A construct to create a private asset S3 bucket. Cognito will be used for token validation with Lambda@Edge.



  ![Diagram](diagrams/all.png)

  Curious how I did the diagram? Have a look here https://martinmueller.dev/cdk-dia-eng .



  ```python
      import { PrivateAssetBucket } from 'cdk-private-assets-bucket';
      ...
      const userPool = new cognito.UserPool(stack, 'userPool', {
        removalPolicy: core.RemovalPolicy.DESTROY,
      });

      const userPoolWebClient = new cognito.UserPoolClient(stack, 'userPoolWebClient', {
        userPool: userPool,
        generateSecret: false,
        preventUserExistenceErrors: true,
        authFlows: {
          adminUserPassword: true,
          userPassword: true,
        },
        oAuth: {
          flows: {
            authorizationCodeGrant: false,
            implicitCodeGrant: true,
          },
        },
      });

      const privateAssetBucket = new PrivateAssetBucket(stack, 'privateAssetBucket', {
        userPoolId: userPool.userPoolId,
        userPoolClientId: userPoolWebClient.userPoolClientId,
        tokenUse: 'access',
      });

      new core.CfnOutput(stack, 'AssetBucketName', {
        value: privateAssetBucket.assetBucketName,
      });

      new core.CfnOutput(stack, 'AssetBucketCloudfrontUrl', {
        value: privateAssetBucket.assetBucketCloudfrontUrl,
      });
  ```



  [API.md](API.md)



  If you forged / cloned that repo you can test directly from here. Don't forget to init with:

  ```bash
  yarn install
  ```

  Create a test cdk stack with one of the following:

  ```bash
  yarn cdk deploy
  yarn cdk deploy --watch
  yarn cdk deploy --require-approval never
  ```

  * Upload a picture named like pic.png to the private asset bucket
  * Create a user pool user and get / save the token:

  ```bash
  USER_POOL_ID=us-east-1_0Aw1oPvD6
  CLIENT_ID=3eqcgvghjbv4d5rv32hopmadu8
  USER_NAME=martindev
  USER_PASSWORD=M@rtindev1
  REGION=us-east-1
  CFD=d1f2bfdek3mzi7.cloudfront.net

  aws cognito-idp admin-create-user --user-pool-id $USER_POOL_ID --username $USER_NAME --region $REGION
  aws cognito-idp admin-set-user-password --user-pool-id $USER_POOL_ID --username $USER_NAME --password $USER_PASSWORD  --permanent --region $REGION
  ACCESS_TOKEN=$(aws cognito-idp initiate-auth --auth-flow USER_PASSWORD_AUTH --client-id $CLIENT_ID --auth-parameters USERNAME=$USER_NAME,PASSWORD=$USER_PASSWORD  --region $REGION | jq -r '.AuthenticationResult.AccessToken')

  echo "curl --location --request GET "https://$CFD/pic.png" --cookie "Cookie: token=$ACCESS_TOKEN""
  ```

  * You can use the curl for importing in Postman. but it looks like Postman can't import the cookie. So you need to set the cookie manually in Postman!
  * In Postman you should see your picture :)
  * For Debugging the Lambda@Edge with Cloudwatch go to the AWS Console --> Cloudwatch --> Log groups --> switch to the region you are closest to --> figure out which log group is correct



  * Support custom authorizer
  * Leverage Cloudfront Function for cheaper costs



  * There is currently my aws-cdk PR open for importing the Typescript Lambda@Edge interface https://github.com/aws/aws-cdk/pull/18836

  ```bash
  git tag -a v2.16.0 -m "prepare tag version" && git push --tags
  ```



  * Crespo Wang for his pioneer work regarding private S3 assets https://javascript.plainenglish.io/use-lambda-edge-jwt-to-secure-s3-bucket-dcca6eec4d7e
  * As always to the amazing CDK / Projen Community. Join us on [Slack](https://cdk-dev.slack.com)!
  * [Projen](https://github.com/projen/projen) project and the community around it.
  * To you for checking this out. Check me out and perhaps give me feedback https://martinmueller.dev .

  I love to work on Content Management Open Source projects. A lot from my stuff you can already use on https://github.com/mmuller88. If you like my work there and my blog posts, please consider supporting me on Patreon:

  <a href='https://patreon.com/bePatron?u=29010217' target='_blank'><img height='36' style='border:0px;height:36px;' src='https://raw.githubusercontent.com/mmuller88/mmuller88/main/patreon.png' border='0' alt='Become a Patreon!' /></a>

  <a href='https://ko-fi.com/T6T1BR59W' target='_blank'><img height='36' style='border:0px;height:36px;' src='https://cdn.ko-fi.com/cdn/kofi2.png?v=3' border='0' alt='Buy Me a Coffee at ko-fi.com' /></a>


pkgId: 9dab979f89535fd7bd8116d26c6318086da329b096b0d730cf32f61ec5285512
name: python-cdk-private-s3-hosting
arch: src
version: 0.0.10
epoch: 0
release: 1
summary: CDK Construct for a private frontend hosting S3 bucket
url: https://github.com/badmintoncryer/cdk-private-s3-hosting.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-private-s3-hosting-0.0.10-1.src.rpm
checksum_type: sha256
description:
  This is a CDK construct that creates a private S3 bucket and an Application Load Balancer (ALB) with a listener rule that forwards requests to the S3 bucket.

  You can use this construct for a enterprise use case where you want to host a static website in a private network.

  Original idea is from [this blog post](https://aws.amazon.com/jp/blogs/networking-and-content-delivery/hosting-internal-https-static-websites-with-alb-s3-and-privatelink/). And some implementations are referenced from [this post](https://qiita.com/k_bobchin/items/c016cc65912a905b90ef).

  [![View on Construct Hub](https://constructs.dev/badge?package=cdk-private-s3-hosting)](https://constructs.dev/packages/cdk-private-s3-hosting)
  [![Open in Visual Studio Code](https://img.shields.io/static/v1?logo=visualstudiocode&label=&message=Open%20in%20Visual%20Studio%20Code&labelColor=2c2c32&color=007acc&logoColor=007acc)](https://open.vscode.dev/badmintoncryer/cdk-private-s3-hosting)
  [![npm version](https://badge.fury.io/js/cdk-private-s3-hosting.svg)](https://badge.fury.io/js/cdk-private-s3-hosting)
  [![Build Status](https://github.com/badmintoncryer/cdk-private-s3-hosting/actions/workflows/build.yml/badge.svg)](https://github.com/badmintoncryer/cdk-private-s3-hosting/actions/workflows/build.yml)
  [![Release Status](https://github.com/badmintoncryer/cdk-private-s3-hosting/actions/workflows/release.yml/badge.svg)](https://github.com/badmintoncryer/cdk-private-s3-hosting/actions/workflows/release.yml)
  [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
  [![npm downloads](https://img.shields.io/npm/dm/cdk-private-s3-hosting.svg?style=flat)](https://www.npmjs.com/package/cdk-private-s3-hosting)



  ![Architecture](./images/private_s3_hosting.png)



  You can install the package via npm:

  ```sh
  npm install cdk-private-s3-hosting
  ```



  To create a private S3 bucket and an ALB with a listener rule that forwards requests to the S3 bucket, you can use the following code:

  ```python
  import { PrivateS3Hosting } from 'cdk-private-s3-hosting';

  const privateS3Hosting = new PrivateS3Hosting(this, 'PrivateS3Hosting', {
    domainName: 'cryer-nao-domain.com',
  });
  ```

  After you deploy the stack, you can access the S3 bucket using the ALB's DNS name from the VPC where the stack is deployed.

  For example, if you put the `hoge.txt` file in the root of S3 bucket, you can access it using the following command:

  ```sh
  curl http://cryer-nao-domain.com/hoge.txt
  ```



  You can use an existing VPC by specifying the `vpc` property.

  ```python
  declare const vpc: ec2.IVpc;

  const privateS3Hosting = new PrivateS3Hosting(this, 'PrivateS3Hosting', {
    domainName: 'cryer-nao-domain.com',
    vpc,
  });
  ```



  You can specify the sub domain by setting the `subDomain` property.

  ```python
  const privateS3Hosting = new PrivateS3Hosting(this, 'PrivateS3Hosting', {
    domainName: 'cryer-nao-domain.com',
    subDomain: 'sub',
  });
  ```

  In this case, the S3 bucket name will be created with `${subDomain}.${domainName}`.

  If `enablePrivateDns` is enabled, a private hosted zone will also be created for the `domainName` and an A record will be created from `${subDomain}.${domainName}` to the ALB DNS name.

  You can retrieve `hoge.txt` on the root of the S3 bucket using the following command:

  ```sh
  curl http://sub.cryer-nao-domain.com/hoge.txt
  ```



  You can deploy the frontend assets to the S3 bucket like below:

  ```python
  import { PrivateS3Hosting } from 'cdk-private-s3-hosting';
  import * as s3deploy from 'aws-cdk-lib/aws-s3-deployment';

  const privateS3Hosting = new PrivateS3Hosting(this, 'PrivateS3Hosting', {
    domainName: 'cryer-nao-domain.com',
  });

  new s3deploy.BucketDeployment(this, 'DeployWebsite', {
    sources: [s3deploy.Source.asset('./website-dist')],
    destinationBucket:  privateS3Hosting.bucket,
  });
  ```

  After deploying the stack, you can access the website using the `domainName` you specified from the VPC.

  ```sh
  [cloudshell-user@ip-10-0-31-170 ~]$ curl http://cryer-nao-domain.com/ -L
  <!doctype html>
  <html lang="en">
    <head>
      <meta charset="UTF-8" />
      <link rel="icon" type="image/svg+xml" href="/vite.svg" />
      <meta name="viewport" content="width=device-width, initial-scale=1.0" />
      <title>Vite + React + TS</title>
      <script type="module" crossorigin src="/assets/index-f40OySzR.js"></script>
      <link rel="stylesheet" crossorigin href="/assets/index-DiwrgTda.css">
    </head>
    <body>
      <div id="root"></div>
    </body>
  </html>
  ```

  **Note**: All access to the path pattern `*/` will be redirected to `/index.html`. Therefore, it will function correctly even when the path is set on the frontend and the page is reloaded.

  **Note**: I also recommend to use [deploy-time-build](https://github.com/tmokmss/deploy-time-build) to build the frontend assets while deploying the stack.



  This construct creates Route53 hosted zone and an A record for the domain name you specified by default.

  If you want to use your own DNS settings(e.g. using a corporate DNS server),
  you can disable the Route53 hosted zone creation by setting the `enablePrivateDns` property to `false`.

  ```python
  import { PrivateS3Hosting } from 'cdk-private-s3-hosting';

  const privateS3Hosting = new PrivateS3Hosting(this, 'PrivateS3Hosting', {
    domainName: 'cryer-nao-domain.com',
    enablePrivateDns: false,
  });
  ```



  If you want to use HTTPS, you need to create a TLS certificate in ACM and pass it to the `certificate` property.

  ```python
  import * as acm from 'aws-cdk-lib/aws-certificatemanager';
  import { PrivateS3Hosting } from 'cdk-private-s3-hosting';

  declare const certificate: acm.ICertificate;

  const privateS3Hosting = new PrivateS3Hosting(this, 'PrivateS3Hosting', {
    domainName: 'cryer-nao-domain.com',
    certificate,
  });
  ```

  Of course, specified domain name (`domainName` and `subDomain`) must be the same as the domain name of the certificate.


pkgId: 3da1c453bfa7135fe180eb7c584850006f3215ad5e7d255eab64782145186d7a
name: python-cdk-proxy-api-client
arch: src
version: 3.0.0
epoch: 0
release: 1
summary: Conduktor Proxy API Client
url: https://pypi.org/project/cdk-proxy-api-client/
rpm_license: LICENSE
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-proxy-api-client-3.0.0-1.src.rpm
checksum_type: sha256
description:
  API Client library to interact with Conduktor Gateway (version >=2,<3)



  The CLI has been removed from this project and moved to [cdk-gw-tools](https://github.com/johnpreston/cdk-gw-tools)


pkgId: 9ae7a7a64043f5b5b52cf86265bc477bf7206213673ddb8b5ed9d327e7779ad0
name: python-cdk-rds-dump
arch: src
version: 2.1.11
epoch: 0
release: 1
summary: CDK Construct Library by Typescript for RDS Dump
url: https://github.com/badmintoncryer/cdk-rds-dump.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-rds-dump-2.1.11-1.src.rpm
checksum_type: sha256
description:
  cdk-rds-dump is a Constructs library for AWS CDK that provides the functionality to dump the contents of Amazon RDS, generate it as an SQL file, and store it in Amazon S3.

  ![Architecture](./image/architecture.png)

  [![View on Construct Hub](https://constructs.dev/badge?package=cdk-rds-dump)](https://constructs.dev/packages/cdk-rds-dump)
  [![Open in Visual Studio Code](https://img.shields.io/static/v1?logo=visualstudiocode&label=&message=Open%20in%20Visual%20Studio%20Code&labelColor=2c2c32&color=007acc&logoColor=007acc)](https://open.vscode.dev/badmintoncryer/cdk-rds-dump)
  [![npm version](https://badge.fury.io/js/cdk-rds-dump.svg)](https://badge.fury.io/js/cdk-rds-dump)
  [![Build Status](https://github.com/badmintoncryer/cdk-rds-dump/actions/workflows/build.yml/badge.svg)](https://github.com/badmintoncryer/cdk-rds-dump/actions/workflows/build.yml)
  [![Release Status](https://github.com/badmintoncryer/cdk-rds-dump/actions/workflows/release.yml/badge.svg)](https://github.com/badmintoncryer/cdk-rds-dump/actions/workflows/release.yml)
  [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
  [![npm downloads](https://img.shields.io/npm/dm/cdk-rds-dump.svg?style=flat)](https://www.npmjs.com/package/cdk-rds-dump)



  Install from npm:

  ```sh
  npm i cdk-rds-dump
  ```

  Then write CDK code as below:

  ```python
  import { RdsDump, DbEngine } from 'cdk-rds-dump';

  declare const rdsCluster: rds.DatabaseCluster;
  new RdsDump(this, "RdsDump", {
    dbEngine: DbEngine.MYSQL,
    rdsCluster: cluster,
    databaseName: "testDatabase",
    schedule: events.Schedule.cron({ minute: "0", hour: "0" }),
    lambdaEnv: {
      ENV_VAR: "value",
    },
    createSecretsManagerVPCEndpoint: true,
    createS3GatewayEndpoint: true,
    // DB secret is obtained from rdsCluster.secret as default.
    // If you want to use a different secret, you can specify it as follows.
    // secretId: 'secretsmanager-secret-id',
  });
  ```



  This code creates a new RDS cluster and uses the RdsDump Construct to dump the data from that RDS cluster. The dumped data is generated as an SQL file and stored in Amazon S3.

  For detailed usage and details of the parameters, refer to the [API documentation](./API.md).



  AWS RDS is a very useful managed RDB service and includes, by default, the ability to create snapshots.
  However, in some cases, such as for development reasons, it is easier to handle SQL files dumped from the DB.
  Therefore, cdk-rds-dump was created as a construct to easily create SQL files on a regular basis.



  Contributions to the project are welcome. Submit improvement proposals via pull requests or propose new features.



  This project is licensed under the Apache-2.0 License.


pkgId: 64da101b9eedd27f9c572b4c128d77b47373e91999405c193d6a6d93c548ac85
name: python-cdk-remote-stack
arch: src
version: 2.1.0
epoch: 0
release: 1
summary: Get outputs and AWS SSM parameters from cross-region AWS CloudFormation stacks
url: https://github.com/pahud/cdk-remote-stack.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-remote-stack-2.1.0-1.src.rpm
checksum_type: sha256
description:
  [![npm version](https://badge.fury.io/js/cdk-remote-stack.svg)](https://badge.fury.io/js/cdk-remote-stack)
  [![PyPI version](https://badge.fury.io/py/cdk-remote-stack.svg)](https://badge.fury.io/py/cdk-remote-stack)
  [![release](https://github.com/pahud/cdk-remote-stack/actions/workflows/release.yml/badge.svg)](https://github.com/pahud/cdk-remote-stack/actions/workflows/release.yml)



  Get outputs and AWS SSM parameters from cross-region AWS CloudFormation stacks



  Use the npm dist tag to opt in CDKv1 or CDKv2:

  ```sh
  // for CDKv2
  npm install cdk-remote-stack
  or
  npm install cdk-remote-stack@latest

  // for CDKv1
  npm install cdk-remote-stack@cdkv1
  ```



  Setting up cross-regional cross-stack references requires using multiple constructs from the AWS CDK construct library and is not straightforward.

  `cdk-remote-stack` aims to simplify the cross-regional cross-stack references to help you easily build cross-regional multi-stack AWS CDK applications.

  This construct library provides two main constructs:

  * **RemoteOutputs** - cross regional stack outputs reference.
  * **RemoteParameters** - cross regional/account SSM parameters reference.



  `RemoteOutputs` is ideal for one stack referencing the outputs from another across different AWS regions.

  Let's say we have two cross-regional stacks in the same AWS CDK application:

  1. **stackJP** - stack in Japan (`JP`) to create a SNS topic
  2. **stackUS** - stack in United States (`US`) to get the outputs from `stackJP` and print out the SNS `TopicName` from `stackJP` outputs.

  ```python
  import { RemoteOutputs } from 'cdk-remote-stack';
  import * as cdk from 'aws-cdk-lib';

  const app = new cdk.App();

  const envJP = {
    region: 'ap-northeast-1',
    account: process.env.CDK_DEFAULT_ACCOUNT,
  };

  const envUS = {
    region: 'us-west-2',
    account: process.env.CDK_DEFAULT_ACCOUNT,
  };

  // first stack in JP
  const stackJP = new cdk.Stack(app, 'demo-stack-jp', { env: envJP })

  new cdk.CfnOutput(stackJP, 'TopicName', { value: 'foo' })

  // second stack in US
  const stackUS = new cdk.Stack(app, 'demo-stack-us', { env: envUS })

  // ensure the dependency
  stackUS.addDependency(stackJP)

  // get the stackJP stack outputs from stackUS
  const outputs = new RemoteOutputs(stackUS, 'Outputs', { stack: stackJP })

  const remoteOutputValue = outputs.get('TopicName')

  // the value should be exactly the same with the output value of `TopicName`
  new cdk.CfnOutput(stackUS, 'RemoteTopicName', { value: remoteOutputValue })
  ```

  At this moment, `RemoteOutputs` only supports cross-regional reference in a single AWS account.



  By default, the `RemoteOutputs` construct will always try to get the latest output from the source stack. You may opt out by setting `alwaysUpdate` to `false` to turn this feature off.

  For example:

  ```python
  const outputs = new RemoteOutputs(stackUS, 'Outputs', {
    stack: stackJP,
    alwaysUpdate: false,
  })
  ```



  [AWS Systems Manager (AWS SSM) Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html) is great to store and persist parameters and allow stacks from other regons/accounts to reference. Let's dive into the two major scenarios below:



  In this sample, we create two stacks from JP (`ap-northeast-1`) and US (`us-west-2`). The JP stack will produce and update parameters in its parameter store, while the US stack will consume the parameters across differnt regions with the `RemoteParameters` construct.

  ![](images/remote-param-1.svg)

  ```python
      const envJP = { region: 'ap-northeast-1', account: '111111111111' };
      const envUS = { region: 'us-west-2', account: '111111111111' };

      // first stack in JP
      const producerStackName = 'demo-stack-jp';
      const stackJP = new cdk.Stack(app, producerStackName, { env: envJP });
      const parameterPath = `/${envJP.account}/${envJP.region}/${producerStackName}`

      new ssm.StringParameter(stackJP, 'foo1', {
        parameterName: `${parameterPath}/foo1`,
        stringValue: 'bar1',
      });
      new ssm.StringParameter(stackJP, 'foo2', {
        parameterName: `${parameterPath}/foo2`,
        stringValue: 'bar2',
      });
      new ssm.StringParameter(stackJP, 'foo3', {
        parameterName: `${parameterPath}/foo3`,
        stringValue: 'bar3',
      });

      // second stack in US
      const stackUS = new cdk.Stack(app, 'demo-stack-us', { env: envUS });

      // ensure the dependency
      stackUS.addDependency(stackJP);

      // get remote parameters by path from AWS SSM parameter store
      const parameters = new RemoteParameters(stackUS, 'Parameters', {
        path: parameterPath,
        region: stackJP.region,
      })

      const foo1 = parameters.get(`${parameterPath}/foo1`);
      const foo2 = parameters.get(`${parameterPath}/foo2`);
      const foo3 = parameters.get(`${parameterPath}/foo3`);

      new cdk.CfnOutput(stackUS, 'foo1Output', { value: foo1 });
      new cdk.CfnOutput(stackUS, 'foo2Output', { value: foo2 });
      new cdk.CfnOutput(stackUS, 'foo3Output', { value: foo3 });
  ```



  Similar to the use case above, but now we deploy stacks in separate accounts and regions.  We will need to pass an AWS Identity and Access Management (AWS IAM) `role` to the `RemoteParameters` construct to get all the parameters from the remote environment.

  ![](images/remote-param-2.svg)

  ```python

      const envJP = { region: 'ap-northeast-1', account: '111111111111' };
      const envUS = { region: 'us-west-2', account: '222222222222' };

      // first stack in JP
      const producerStackName = 'demo-stack-jp';
      const stackJP = new cdk.Stack(app, producerStackName, { env: envJP });
      const parameterPath = `/${envJP.account}/${envJP.region}/${producerStackName}`

      new ssm.StringParameter(stackJP, 'foo1', {
        parameterName: `${parameterPath}/foo1`,
        stringValue: 'bar1',
      });
      new ssm.StringParameter(stackJP, 'foo2', {
        parameterName: `${parameterPath}/foo2`,
        stringValue: 'bar2',
      });
      new ssm.StringParameter(stackJP, 'foo3', {
        parameterName: `${parameterPath}/foo3`,
        stringValue: 'bar3',
      });

      // allow US account to assume this read only role to get parameters
      const cdkReadOnlyRole = new iam.Role(stackJP, 'readOnlyRole', {
        assumedBy: new iam.AccountPrincipal(envUS.account),
        roleName: PhysicalName.GENERATE_IF_NEEDED,
        managedPolicies: [ iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMReadOnlyAccess')],
      })

      // second stack in US
      const stackUS = new cdk.Stack(app, 'demo-stack-us', { env: envUS });

      // ensure the dependency
      stackUS.addDependency(stackJP);

      // get remote parameters by path from AWS SSM parameter store
      const parameters = new RemoteParameters(stackUS, 'Parameters', {
        path: parameterPath,
        region: stackJP.region,
        // assume this role for cross-account parameters
        role: iam.Role.fromRoleArn(stackUS, 'readOnlyRole', cdkReadOnlyRole.roleArn),
      })

      const foo1 = parameters.get(`${parameterPath}/foo1`);
      const foo2 = parameters.get(`${parameterPath}/foo2`);
      const foo3 = parameters.get(`${parameterPath}/foo3`);

      new cdk.CfnOutput(stackUS, 'foo1Output', { value: foo1 });
      new cdk.CfnOutput(stackUS, 'foo2Output', { value: foo2 });
      new cdk.CfnOutput(stackUS, 'foo3Output', { value: foo3 });
  ```



  The parameters are stored in a centralized account/region and previously provisioned as a source-of-truth configuration store. All other stacks from different accounts/regions are consuming the parameters from the central configuration store.

  This scenario is pretty much like #2. The difference is that there's a dedicated account for centralized configuration store being shared with all other accounts.

  ![](images/remote-param-3.svg)

  You will need create `RemoteParameters` for all the consuming stacks like:

  ```python
  // for StackUS
  new RemoteParameters(stackUS, 'Parameters', {
    path: parameterPath,
    region: 'eu-central-1'
    // assume this role for cross-account parameters
    role: iam.Role.fromRoleArn(stackUS, 'readOnlyRole', sharedReadOnlyRoleArn),
  })

  // for StackJP
  new RemoteParameters(stackJP, 'Parameters', {
    path: parameterPath,
    region: 'eu-central-1'
    // assume this role for cross-account parameters
    role: iam.Role.fromRoleArn(stackJP, 'readOnlyRole', sharedReadOnlyRoleArn),
  })
  ```



  You will need to install and bootstrap your target accounts with AWS CDK 1.108.0 or later, so you can deploy stacks from different accounts. It [adds support](https://github.com/aws/aws-cdk/pull/14874) for cross-account lookups. Alternatively, install [cdk-assume-role-credential-plugin](https://github.com/aws-samples/cdk-assume-role-credential-plugin). Read this [blog post](https://aws.amazon.com/tw/blogs/devops/cdk-credential-plugin/) to setup this plugin.



  1. At this moment, the `RemoteParameters` construct only supports the `String` data type from parameter store.
  2. Maximum number of parameters is `100`. Will make it configurable in the future if required.



  See [CONTRIBUTING](CONTRIBUTING.md) for more information.



  This code is licensed under the Apache License 2.0. See the [LICENSE](LICENSE) file.


pkgId: e87d67890e079ddffc3f134c8932103813cc932f75cc8cd91f0b5b85992508b1
name: python-cdk-secret-manager-wrapper-layer
arch: src
version: 2.0.762
epoch: 0
release: 1
summary: cdk-secret-manager-wrapper-layer
url: https://github.com/neilkuan/cdk-secret-manager-wrapper-layer.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-secret-manager-wrapper-layer-2.0.762-1.src.rpm
checksum_type: sha256
description:
  that Lambda layer uses a wrapper script to fetch information from Secrets Manager and create environmental variables.

  > idea from [source](https://github.com/aws-samples/aws-lambda-environmental-variables-from-aws-secrets-manager)



  ```python
  import { App, Stack, CfnOutput, Duration } from 'aws-cdk-lib';
  import { Effect, PolicyStatement } from 'aws-cdk-lib/aws-iam';
  import { Function, Runtime, Code, FunctionUrlAuthType } from 'aws-cdk-lib/aws-lambda';
  import { CfnSecret } from 'aws-cdk-lib/aws-secretsmanager';
  import { SecretManagerWrapperLayer } from 'cdk-secret-manager-wrapper-layer';
  const env = {
    region: process.env.CDK_DEFAULT_REGION,
    account: process.env.CDK_DEFAULT_ACCOUNT,
  };
  const app = new App();
  const stack = new Stack(app, 'testing-stack', { env });

  /**
   * Example create an Secret for testing.
   */
  const secret = new CfnSecret(stack, 'Mysecret', {
    secretString: JSON.stringify({
      KEY1: 'VALUE1',
      KEY2: 'VALUE2',
      KEY3: 'VALUE3',
    }),
  });

  const layer = new SecretManagerWrapperLayer(stack, 'SecretManagerWrapperLayer');

  const lambda = new Function(stack, 'fn', {
    runtime: Runtime.PYTHON_3_9,
    code: Code.fromInline(`
  import os
  def hander(events, contexts):
      env = {}
      env['KEY1'] = os.environ.get('KEY1', 'Not Found')
      env['KEY2'] = os.environ.get('KEY2', 'Not Found')
      env['KEY3'] = os.environ.get('KEY3', 'Not Found')
      return env
      `),
    handler: 'index.hander',
    layers: [layer],
    timeout: Duration.minutes(1),
    /**
     * you need to define this 4 environment various.
     */
    environment: {
      AWS_LAMBDA_EXEC_WRAPPER: '/opt/get-secrets-layer',
      SECRET_REGION: stack.region,
      SECRET_ARN: secret.ref,
      API_TIMEOUT: '5000',
    },
  });

  /**
   * Add Permission for lambda get secret value from secret manager.
   */
  lambda.role!.addToPrincipalPolicy(
    new PolicyStatement({
      effect: Effect.ALLOW,
      actions: ['secretsmanager:GetSecretValue'],
      // Also you can use find from context.
      resources: [secret.ref],
    }),
  );

  /**
   * For Testing.
   */
  const FnUrl = lambda.addFunctionUrl({
    authType: FunctionUrlAuthType.NONE,
  });

  new CfnOutput(stack, 'FnUrl', {
    value: FnUrl.url,
  });
  ```



  ```bash

  curl ${FnUrl}
  {"KEY2":"VALUE2","KEY1":"VALUE1","KEY3":"VALUE3"}
  ```


pkgId: 6eef577056129fe2891880ff2e3bbf4d9ceae449022297840cd344a6eee2eea5
name: python-cdk-serverless-clamscan
arch: src
version: 2.8.27
epoch: 0
release: 1
summary: Serverless architecture to virus scan objects in Amazon S3.
url: https://github.com/awslabs/cdk-serverless-clamscan
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-serverless-clamscan-2.8.27-1.src.rpm
checksum_type: sha256
description:
  [![npm version](https://badge.fury.io/js/cdk-serverless-clamscan.svg)](https://badge.fury.io/js/cdk-serverless-clamscan)
  [![PyPI version](https://badge.fury.io/py/cdk-serverless-clamscan.svg)](https://badge.fury.io/py/cdk-serverless-clamscan)

  An [aws-cdk](https://github.com/aws/aws-cdk) construct that uses [ClamAV®](https://www.clamav.net/) to scan newly uploaded objects to Amazon S3 for viruses. The construct provides a flexible interface for a system to act based on the results of a ClamAV virus scan. Check out this [blogpost](https://aws.amazon.com/blogs/developer/virus-scan-s3-buckets-with-a-serverless-clamav-based-cdk-construct/) for a guided walkthrough.

  ![Overview](serverless-clamscan.png)



  **Docker:** The ClamAV Lambda functions utilizes a [container image](https://aws.amazon.com/blogs/aws/new-for-aws-lambda-container-image-support/) that is built locally using [docker bundling](https://aws.amazon.com/blogs/devops/building-apps-with-aws-cdk/)



  This project uses [projen](https://github.com/projen/projen) and thus all the constructs follow language specific standards and naming patterns. For more information on how to translate the following examples into your desired language read the CDK guide on [Translating TypeScript AWS CDK code to other languages](https://docs.aws.amazon.com/cdk/latest/guide/multiple_languages.html)



  <details><summary>typescript</summary>
  <p>

  ```python
  import { RuleTargetInput } from 'aws-cdk-lib/aws-events';
  import { SnsTopic } from 'aws-cdk-lib/aws-events-targets';
  import { Bucket } from 'aws-cdk-lib/aws-s3';
  import { Topic } from 'aws-cdk-lib/aws-sns';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { ServerlessClamscan } from 'cdk-serverless-clamscan';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);

      const bucket_1 = new Bucket(this, 'rBucket1');
      const bucket_2 = new Bucket(this, 'rBucket2');
      const bucketList = [bucket_1, bucket_2];
      const sc = new ServerlessClamscan(this, 'rClamscan', {
        buckets: bucketList,
      });
      const bucket_3 = new Bucket(this, 'rBucket3');
      sc.addSourceBucket(bucket_3);
      const infectedTopic = new Topic(this, 'rInfectedTopic');
      sc.infectedRule?.addTarget(
        new SnsTopic(infectedTopic, {
          message: RuleTargetInput.fromEventPath(
            '$.detail.responsePayload.message',
          ),
        }),
      );
    }
  }
  ```

  </p>
  </details><details><summary>python</summary>
  <p>

  ```python
  from aws_cdk import (
    Stack,
    aws_events as events,
    aws_events_targets as events_targets,
    aws_s3 as s3,
    aws_sns as sns
  )
  from cdk_serverless_clamscan import ServerlessClamscan
  from constructs import Construct

  class CdkTestStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
      super().__init__(scope, construct_id, **kwargs)

      bucket_1 = s3.Bucket(self, "rBucket1")
      bucket_2 = s3.Bucket(self, "rBucket2")
      bucketList = [ bucket_1, bucket_2 ]
      sc = ServerlessClamscan(self, "rClamScan",
        buckets=bucketList,
      )
      bucket_3 = s3.Bucket(self, "rBucket3")
      sc.add_source_bucket(bucket_3)
      infected_topic = sns.Topic(self, "rInfectedTopic")
      if sc.infected_rule != None:
        sc.infected_rule.add_target(
          events_targets.SnsTopic(
            infected_topic,
            message=events.RuleTargetInput.from_event_path('$.detail.responsePayload.message'),
          )
        )
  ```

  </p>
  </details>



  <details><summary>typescript</summary>
  <p>

  ```python
  import {
    SqsDestination,
    EventBridgeDestination,
  } from 'aws-cdk-lib/aws-lambda-destinations';
  import { Bucket } from 'aws-cdk-lib/aws-s3';
  import { Queue } from 'aws-cdk-lib/aws-sqs';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import { ServerlessClamscan } from 'cdk-serverless-clamscan';

  export class CdkTestStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);

      const bucket_1 = new Bucket(this, 'rBucket1');
      const bucket_2 = new Bucket(this, 'rBucket2');
      const bucketList = [bucket_1, bucket_2];
      const queue = new Queue(this, 'rQueue');
      const sc = new ServerlessClamscan(this, 'default', {
        buckets: bucketList,
        onResult: new EventBridgeDestination(),
        onError: new SqsDestination(queue),
      });
      const bucket_3 = new Bucket(this, 'rBucket3');
      sc.addSourceBucket(bucket_3);
    }
  }
  ```

  </p>
  </details><details><summary>python</summary>
  <p>

  ```python
  from aws_cdk import (
    Stack,
    aws_lambda_destinations as lambda_destinations,
    aws_s3 as s3,
    aws_sqs as sqs
  )
  from cdk_serverless_clamscan import ServerlessClamscan
  from constructs import Construct

  class CdkTestStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
      super().__init__(scope, construct_id, **kwargs)

      bucket_1 = s3.Bucket(self, "rBucket1")
      bucket_2 = s3.Bucket(self, "rBucket2")
      bucketList = [ bucket_1, bucket_2 ]
      queue = sqs.Queue(self, "rQueue")
      sc = ServerlessClamscan(self, "rClamScan",
        buckets=bucketList,
        on_result=lambda_destinations.EventBridgeDestination(),
        on_error=lambda_destinations.SqsDestination(queue),
      )
      bucket_3 = s3.Bucket(self, "rBucket3")
      sc.add_source_bucket(bucket_3)
  ```

  </p>
  </details>



  When ClamAV publishes updates to the scanner you will see “Your ClamAV installation is OUTDATED” in your scan results. While the construct creates a system to keep the database definitions up to date, you must update the scanner to detect all the latest Viruses.

  Update the docker images of the Lambda functions with the latest version of ClamAV by re-running `cdk deploy`.



  See [API.md](./API.md).



  See [CONTRIBUTING](./CONTRIBUTING.md) for more information.



  This project is licensed under the Apache-2.0 License.


pkgId: c16ce5855e6d9c90979e8efa2c41e8ae7dfff40941f41320a92e21537cb6a07f
name: python-cdk-simple-serverless
arch: src
version: 2.0.300
epoch: 0
release: 1
summary: CDK Constructs for Serverless Demo
url: https://github.com/pahud/cdk-simple-serverless.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-simple-serverless-2.0.300-1.src.rpm
checksum_type: sha256
description:
  [![npm version](https://badge.fury.io/js/cdk-simple-serverless.svg)](https://badge.fury.io/js/cdk-simple-serverless)
  [![PyPI version](https://badge.fury.io/py/cdk-simple-serverless.svg)](https://badge.fury.io/py/cdk-simple-serverless)
  [![release](https://github.com/pahud/cdk-simple-serverless/actions/workflows/release.yml/badge.svg)](https://github.com/pahud/cdk-simple-serverless/actions/workflows/release.yml)

  ![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)



  Tiny serverless constructs wih all optional construct properties to keep it as simple as possible for demo out of the box.



  Use the npm dist tag to opt in CDKv1 or CDKv2:

  ```sh
  // for CDKv2
  npm install cdk-simple-serverless
  or
  npm install cdk-simple-serverless@latest

  // for CDKv1
  npm install cdk-simple-serverless@cdkv1
  ```



  AWS Lambda function that returns `"Hello CDK!"` only.

  ```python
  import { HelloFunction } from 'cdk-simple-serverless'

  new HelloFunction(stack, 'Function')
  ```



  Amazon API Gateway REST API service that returns `"Hello CDK!"` only in the HTTP response.

  ```python
  import { HelloRestApiService } from 'cdk-simple-serverless'

  new HelloRestApiService(stack, 'Service')
  ```


pkgId: 1567f5506b06fb79959247076435c8e7a3a2c78668a110deccf31d6a478cd8a3
name: python-cdk-simplewebsite-deploy
arch: src
version: 2.0.84
epoch: 0
release: 1
url: https://github.com/SnapPetal/cdk-simplewebsite-deploy
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-simplewebsite-deploy-2.0.84-1.src.rpm
checksum_type: sha256
summary:
  This is an AWS CDK v2 Construct to simplify deploying a single-page website use CloudFront distributions.

description:
  [![License](https://img.shields.io/badge/License-Apache%202.0-yellowgreen.svg)](https://opensource.org/licenses/Apache-2.0)
  ![Build](https://github.com/SnapPetal/cdk-simplewebsite-deploy/workflows/build/badge.svg)
  ![Release](https://github.com/SnapPetal/cdk-simplewebsite-deploy/workflows/release/badge.svg?branch=main)



  This is an AWS CDK Construct to simplify deploying a single-page website using either S3 buckets or CloudFront distributions.









  ```console
  npm install cdk-simplewebsite-deploy
  ```

  ```python
  import * as cdk from '@aws-cdk/core';
  import { CreateBasicSite } from 'cdk-simplewebsite-deploy';

  export class PipelineStack extends cdk.Stack {
    constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
      super(scope, id, props);

      new CreateBasicSite(stack, 'test-website', {
        websiteFolder: './src/build',
        indexDoc: 'index.html',
        hostedZone: 'example.com',
      });
    }
  }
  ```



  ```console
  dotnet add package ThonBecker.CDK.SimpleWebsiteDeploy
  ```

  ```cs
  using Amazon.CDK;
  using ThonBecker.CDK.SimpleWebsiteDeploy;

  namespace SimpleWebsiteDeploy
  {
      public class PipelineStack : Stack
      {
          internal PipelineStack(Construct scope, string id, IStackProps props = null) : base(scope, id, props)
          {
              new CreateBasicSite(scope, "test-website", new BasicSiteConfiguration()
              {
                  WebsiteFolder = "./src/build",
                  IndexDoc = "index.html",
                  HostedZone = "example.com",
              });
          }
      }
  }
  ```



  ```xml
  <dependency>
  	<groupId>com.thonbecker.simplewebsitedeploy</groupId>
  	<artifactId>cdk-simplewebsite-deploy</artifactId>
  	<version>0.4.2</version>
  </dependency>
  ```

  ```java
  package com.myorg;

  import software.amazon.awscdk.core.Construct;
  import software.amazon.awscdk.core.Stack;
  import software.amazon.awscdk.core.StackProps;
  import com.thonbecker.simplewebsitedeploy.CreateBasicSite;

  public class MyProjectStack extends Stack {
      public MyProjectStack(final Construct scope, final String id) {
          this(scope, id, null);
      }

      public MyProjectStack(final Construct scope, final String id, final StackProps props) {
          super(scope, id, props);

          CreateBasicSite.Builder.create(this, "test-website")
          		.websiteFolder("./src/build")
          		.indexDoc("index.html")
          		.hostedZone("example.com");
      }
  }
  ```



  ```console
  pip install cdk-simplewebsite-deploy
  ```

  ```python
  from aws_cdk import Stack
  from cdk_simplewebsite_deploy import CreateBasicSite
  from constructs import Construct

  class MyProjectStack(Stack):

      def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
          super().__init__(scope, construct_id, **kwargs)

          CreateBasicSite(self, 'test-website', website_folder='./src/build',
                          index_doc='index.html',
                          hosted_zone='example.com')
  ```







  ```console
  npm install cdk-simplewebsite-deploy
  ```

  ```python
  import * as cdk from '@aws-cdk/core';
  import { CreateCloudfrontSite } from 'cdk-simplewebsite-deploy';

  export class PipelineStack extends cdk.Stack {
    constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
      super(scope, id, props);

      new CreateCloudfrontSite(stack, 'test-website', {
        websiteFolder: './src/dist',
        indexDoc: 'index.html',
        hostedZone: 'example.com',
        subDomain: 'www.example.com',
      });
    }
  }
  ```



  ```console
  dotnet add package ThonBecker.CDK.SimpleWebsiteDeploy
  ```

  ```cs
  using Amazon.CDK;
  using ThonBecker.CDK.SimpleWebsiteDeploy;

  namespace SimpleWebsiteDeploy
  {
      public class PipelineStack : Stack
      {
          internal PipelineStack(Construct scope, string id, IStackProps props = null) : base(scope, id, props)
          {
              new CreateCloudfrontSite(scope, "test-website", new CloudfrontSiteConfiguration()
              {
                  WebsiteFolder = "./src/build",
                  IndexDoc = "index.html",
                  HostedZone = "example.com",
                  SubDomain = "www.example.com",
              });
          }
      }
  }
  ```



  ```xml
  <dependency>
  	<groupId>com.thonbecker.simplewebsitedeploy</groupId>
  	<artifactId>cdk-simplewebsite-deploy</artifactId>
  	<version>0.4.2</version>
  </dependency>
  ```

  ```java
  package com.myorg;

  import software.amazon.awscdk.core.Construct;
  import software.amazon.awscdk.core.Stack;
  import software.amazon.awscdk.core.StackProps;
  import com.thonbecker.simplewebsitedeploy.CreateCloudfrontSite;

  public class MyProjectStack extends Stack {
      public MyProjectStack(final Construct scope, final String id) {
          this(scope, id, null);
      }

      public MyProjectStack(final Construct scope, final String id, final StackProps props) {
          super(scope, id, props);

          CreateCloudfrontSite.Builder.create(this, "test-website")
          		.websiteFolder("./src/build")
          		.indexDoc("index.html")
          		.hostedZone("example.com")
          		.subDomain("www.example.com");
      }
  }
  ```



  ```console
  pip install cdk-simplewebsite-deploy
  ```

  ```python
  from aws_cdk import core
  from cdk_simplewebsite_deploy import CreateCloudfrontSite


  class MyProjectStack(core.Stack):

      def __init__(self, scope: core.Construct, construct_id: str, **kwargs) -> None:
          super().__init__(scope, construct_id, **kwargs)

          CreateCloudfrontSite(self, 'test-website', website_folder='./src/build',
                               index_doc='index.html',
                               hosted_zone='example.com',
                               sub_domain='www.example.com')
  ```



  Distributed under the [Apache-2.0](./LICENSE) license.


pkgId: 6f2c4405efcf9460204b47c69f37ed98dd7f0966acf67f5023bc81ed7ae0527e
name: python-cdk-skill-management
arch: src
version: 1.0.40
epoch: 0
release: 1
summary: CDK constructs to manage Alexa Skills
url: https://github.com/t0bst4r/cdk-skill-management.git
rpm_license: MIT
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-skill-management-1.0.40-1.src.rpm
checksum_type: sha256
description:
  [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
  [![Build status](https://img.shields.io/github/actions/workflow/status/t0bst4r/cdk-skill-management/release.yml?logo=github)](https://github.com/t0bst4r/cdk-skill-management)

  [![Github version](https://img.shields.io/github/v/release/t0bst4r/cdk-skill-management?logo=github)](https://github.com/t0bst4r/cdk-skill-management)
  [![npm](https://img.shields.io/npm/v/cdk-skill-management?logo=npm)](https://www.npmjs.com/package/cdk-skill-management)
  [![PyPI version](https://img.shields.io/pypi/v/cdk-skill-management?logo=pypi)](https://pypi.org/project/cdk-skill-management/)

  > Since I am only working with Node.js and TypeScript, the Python package is currently not tested / used.
  > Therefore I am looking for someone to use and test it to provide feedback, if the library is actually working and if there are best practices to apply (e.g. namings, module name, etc.).

  Your library for creating and managing Alexa Skills via CloudFormation using AWS CDK.



  * [Installation](#installation)
  * [Usage](#usage)
  * [Contributing](#contributing)
  * [License](#license)
  * [Changelog](https://github.com/t0bst4r/cdk-skill-management/blob/main/CHANGELOG.md)





  To install the Node.js version of this library, use npm or yarn:

  ```bash
  npm install cdk-skill-management

  yarn add cdk-skill-management
  ```



  To install the Python version of this library, use pip:

  ```bash
  pip install cdk-skill-management
  ```



  To use this library in your AWS CDK project, import and instantiate the classes you need.

  You can find the API-Documentation in [GitHub Pages](https://t0bst4r.github.io/cdk-skill-management/).



  Skills can be deployed in every AWS regions, but Lambda Endpoints are restricted to

  * North America: `arn:aws:lambda:us-east-1:<aws_account_id>:function:<lambda_name>`
  * Europe, India: `arn:aws:lambda:eu-west-1:<aws_account_id>:function:<lambda_name>`
  * Far East: `arn:aws:lambda:location<aws_account_id>:function:<lambda_name>`



  * You can use `skillPackage.overrides` to patch your lambda function ARN into your skill package.
  * Make sure to call `addDependency` on your skill instance.



  In order for Alexa to call the skill endpoint - i.e. the Lambda function - a resource based permission must be added to allow the Alexa Service Principal to call the function.
  However, this would cause any Alexa Skill to be able to call the endpoint. Therefore, the skill-id should be added as a condition to the permission.

  However, when deploying the skill, Alexa immediately checks if the skill endpoint is allowed to be accessed. At this point, we do not have a skill id to add to the resource based permission.

  Therefore, this library includes a construct `SkillEndpointPermission`, which first creates a resource based permission that allows Alexa to call `invokeFunction` in general.

  After the creation of the Skill, the Skill Id can be injected into the Permission. To do this, simply call the `configureSkillId` method on the `SkillEndpointPermission`.



  Here's an example including the `skillPackage.overrides` and `SkillEndpointPermission`.

  ```python
  import * as cdk from 'aws-cdk-lib';
  import * as lambda from 'aws-cdk-lib/aws-lambda';
  import * as s3Assets from 'aws-cdk-lib/aws-s3-assets';
  import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
  import * as ssm from 'aws-cdk-lib/aws-ssm';
  import {Construct} from 'constructs';

  import * as skill from 'cdk-skill-management';

  export class MyStack extends cdk.Stack {
    constructor(scope: Construct, id: string, props: cdk.StackProps = {}) {
      super(scope, id, props);

      const vendorParameter = ssm.StringParameter
        .fromStringParameterName(this, 'VendorIdParameter', 'my-skill-vendor-id');
      const skillCredentials = secretsmanager
        .Secret.fromSecretNameV2(this, 'SkillCredentials', 'my-skill-authentication');
      const asset = new s3Assets.Asset(this, 'SkillPackageAsset', {path: './path/to/my/skill-package'});

      const myFunction = new lambda.Function(this, 'MyEndpointFunction', {...});
      const endpointPermission = new skill.SkillEndpointPermission(this, 'EndpointPermission', {
        handler: myFunction,
        skillType: skill.SkillType.SMART_HOME,
      });

      const mySkill = new skill.Skill(this, 'Skill', {
        skillType: skill.SkillType.SMART_HOME,
        skillStage: 'development',
        vendorId: vendorParameter.stringValue,
        authenticationConfiguration: {
          clientId: skillCredentials.secretValueFromJson('clientId').unsafeUnwrap(),
          clientSecret: skillCredentials.secretValueFromJson('clientSecret').unsafeUnwrap(),
          refreshToken: skillCredentials.secretValueFromJson('refreshToken').unsafeUnwrap(),
        },
        skillPackage: {
          asset,
          overrides: {
            manifest: {
              apis: {
                smartHome: {
                  endpoint: {
                    uri: myFunction.functionArn
                  }
                }
              }
            }
          }
        },
      });
      mySkill.addDependency(myFunction);
      mySkill.addDependency(endpointPermission);

      endpointPermission.configureSkillId(this, 'EndpointPermissionSkill', mySkill);
    }
  }
  ```



  We welcome contributions from the community. To contribute, please follow our [contribution guidelines](https://github.com/t0bst4r/cdk-skill-management/blob/main/CONTRIBUTE.md).



  This library is licensed under the MIT License - see the [LICENSE](https://github.com/t0bst4r/cdk-skill-management/blob/main/LICENSE.txt) file for details.

  This library bundles `ask-smapi-sdk` and `ask-smapi-model` into a custom resource lambda function.
  Those are licensed under the Apache License 2.0 - see the [LICENSE-EXTERNAL](https://github.com/t0bst4r/cdk-skill-management/blob/main/LICENSE-EXTERNAL.txt) for details.


pkgId: 3b4441906445b1d14391587a826088882f55ffa4ef2233acd3e08019cf0552e8
name: python-cdk-skylight
arch: src
version: 1.1.591
epoch: 0
release: 1
summary: cdk-skylight
url: https://github.com/cdklabs/cdk-skylight.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-skylight-1.1.591-1.src.rpm
checksum_type: sha256
description:
  ![](https://img.shields.io/badge/CDK%20Skylight-Developer%20Preview-orange.svg?style=for-the-badge)



  CDK Skylight is a set of **Level 3 constructs** for the [Microsoft products on AWS](https://aws.amazon.com/windows/) ecosystem (Windows OS, SQL Server, Active Directory, Windows Containers, Amazon FSx for Windows, and so on). **CDK Skylight Constructs are a natural fit for Platform Teams building Platform as a Product.**

  A few examples are:

  1. Windows Worker with Domain join and Powershell API that allows running complex automation with a single line of code
  2. Managed Active Directory configured with DNS Topology and an API to create new AD Group with a domain-joined machine.
  3. Amazon FSx library that creates Filesystem with API to create Folder on it
  4. Windows EKS Workers that joins to specified AD domain with APIs to create and configure complex integrations such as SMB with Global Mapping and Domain authentication with gMSA plugin.

  All those examples are built with CDK Skylight libraries and can be used separately with maximum flexibility to change the default settings.

  CDK Skylight is set to address repetitive tasks and best practices involved with managing, deploying, and integrating those apps. In addition to the complexity of integrating the AWS side products, Microsoft technologies such as SQL, AD, Windows OS require OS-level integration and optimization. Skylight help in both the "AWS-side" and the "OS-side," offering a complete end-to-end configuration and integration solution of AWS products.



  The primary persona to use CDK Skylight is the platform team owners to customize the stacks and provide them to the application owners teams.

  As a vision, Project CDK-Skylight targets all Windows EC2 customers in all stages, specifically developers developing features integrated with the Microsoft-products ecosystem (SQL Server, Active Directory, Windows OS, etc.)



  CDK Skylight helps in all application lifecycle stages, starting from the developer machine to running production workloads. With CDK Skylight, the time it takes to move between stages and integrate new services is reduced dramatically.



  ```bash
  npm install cdk-skylight
  ```

  In your CDK App

  ```python
  import * as skylight from "cdk-skylight";

  new skylight.authentication.AwsManagedMicrosoftAdR53(scope: Construct, id: string, props: IAwsManagedMicrosoftAdProps)
  ```





  Library of Custom Compute components



  A Domain Windows Node Construct represents one Windows EC2 instance configured with Active Directory.

  The DomainWindowsNode can be customized to different instance sizes and additional permissions set just like any other EC2 Instance.
  You can use this construct to run elevated domain tasks with domain permissions or run your application in a single instance setup.

  The machine will be joined to the provided Active Directory domain using a custom CloudFormation bootstrap that will wait until the required reboot to join the domain. Then it will register the machine in SSM and pull tasks from the SSM State manager.

  You can send tasks to that machine using the provided methods: runPsCommands() and runPSwithDomainAdmin()

  ```python
  const windowsNodeObject = new skylight.compute.DomainWindowsNode(
    stack,
    'WindowsNode',
    {
      vpc: vpc,
      madSsmParameters: {}, //pointer to the Secret that holds the Domain Admin username and password
    }
  );

  // Special Methods:
  windowsNodeObject.runPsCommands(['echo hello-world'], 'hello');
  windowsNodeObject.runPSwithDomainAdmin(
    ['Write-Host hello-world'],
    'hello-withPS'
  );
  windowsNodeObject.openRDP('1.1.1.1/32');
  ```



  Library of Custom Authentication components



  Managed AD with Secret stored in secret manager

  The secret saved to SSM parameter store so others can use it with other Constructs (Such as Windows node or FSx)
  The provided VPC or the new created VPC will be configured to forward DNS requests to the Managed AD with Route53 Resolvers

  The construct also creates (optionally) t3.nano machine that is part of the domain that can be used to run admin-tasks (such as createADGroup)
  The createADGroup() method creates an Active Directory permission group in the domain, using the domain admin user.

  Please note: When calling createADGroup() API, a Lambda will be created to start the worker machine (Using AWS-SDK),
  then each command will be scheduled with State Manager, and the instance will be shut down after complete.

  ```python
  const ad = new skylight.authentication.AwsManagedMicrosoftAd(
    stack,
    'AwsManagedMicrosoftAdR53',
    {
      vpc: vpc,
      edition: 'Enterprise', // Optional
      secret: new Secret(stack, 'test-secret'), // Optional
      domainName: 'test-domain', // Optional
      secretName: 'custom-secret-name', // Optional
      createWorker: false, // Optional
    }
  );
  ad.managedActiveDirectory.createADGroup(
    'MyADGroup', // AD group name
    'My AD Group Created by CDK-Skylight!' //AD Description
  );
  ```



  AwsManagedMicrosoftAdR53 represents an integration pattern of Managed AD and Route 53 Resolver in a specific VPC, it will create Managed AD with the provided Secret (Secrets Manager) or generates a new Secret.

  Example:

  ```python
  const ad = new skylight.authentication.AwsManagedMicrosoftAdR53(
    stack,
    'AwsManagedMicrosoftAdR53',
    {
      vpc: vpc,
    }
  );
  ```





  A FSxWindows represents an integration pattern of Amazon FSx and Managed AD in a specific VPC.
  The Construct creates Amazon FSx for Windows

  The construct also creates t3.nano machine that is part of the domain that can be used to run admin-tasks (such as createFolder)
  The createFolder() method creates an SMB Folder in the FSx filesystem, using the domain admin user.

  Please note: When calling createFolder() API, a Lambda will be created to start the worker machine (Using AWS-SDK), then each command will be scheduled with State Manager, and the instance will be shut down after complete.

  Example:

  ```python
  this.fsxWindows = new skylight.storage.FSxWindows(this, 'FSx', {
    vpc: vpc,
    adParametersStore: adParametersStore,
  });
  this.fsxWindows.createFolder('myFolderStorageOnFSx');
  ```





  The stack creates the Windows Autoscaling group with domain join script and the SSM Documents for gMSA and Global Mapping.



  ```python
  const cluster = new WindowsEKSCluster(stack, 'ElasticCluster', {
    vpc: new aws_ec2.Vpc(stack, 'MyVpc', {}),
  }); // Creates EKS Cluster with Windows support
  ```



  This stack takes the PersistentStorage stack as input and creates the EKS cluster with permissions to operate EKS clusters.

  ```python
  const myNodes = new WindowsEKSNodes(stack, 'WindowsEKSNodes', {
    // Creates AutoScaling group for Windows Support
    vpc: new aws_ec2.Vpc(stack, 'MyVpc', {}),
  });

  myNodes.addAdDependency(secretObject);
  myNodes.addStorageDependency(secretObject, storageMount);
  myNodes.addEKSDependency(eks_cluster.eksCluster);
  myNodes.addLocalCredFile(secretObject, 'myEKSNodes', 'myWebApp');
  ```


pkgId: c3aef41b9cb1ceeec150b01fe7597c45015c07072e865d2bdf0c15fa6a4bd143
name: python-cdk-slack-chatbot
arch: src
version: 1.0.198
epoch: 0
release: 1
summary: cdk-slack-chatbot
url: https://github.com/lvthillo/cdk-slack-chatbot.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-slack-chatbot-1.0.198-1.src.rpm
checksum_type: sha256
description:
  [![NPM version](https://badge.fury.io/js/cdk-slack-chatbot.svg)](https://badge.fury.io/js/cdk-slack-chatbot)
  [![PyPI version](https://badge.fury.io/py/cdk-slack-chatbot.svg)](https://badge.fury.io/py/cdk-slack-chatbot)
  ![Release](https://github.com/lvthillo/cdk-slack-chatbot/workflows/release/badge.svg)



  A CDK construct which creates an SNS AWS ChatBot (Slack) integration for CloudWatch alarms, AWS Config rules, ...\
  More information on how to use this construct can be found [here](https://github.com/lvthillo/cdk-slack-chatbot/blob/main/API.md).







  In this example we create a CloudWatch alarm which integrates with our construct.

  ```python
  import * as cdk from 'aws-cdk-lib';
  import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
  import * as cloudwatch_actions from 'aws-cdk-lib/aws-cloudwatch-actions';
  import * as sqs from 'aws-cdk-lib/aws-sqs';
  import { CdkSlackChatBot } from 'cdk-slack-chatbot';

  export class CdkDemoStack extends cdk.Stack {
    constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
      super(scope, id, props);

      const queue = new sqs.Queue(this, 'HelloCdkQueue', {
        visibilityTimeout: cdk.Duration.seconds(300)
      });

      const qMetric = queue.metric('ApproximateNumberOfMessagesVisible');

      const alarm = new cloudwatch.Alarm(this, 'Alarm', {
        metric: qMetric,
        threshold: 100,
        evaluationPeriods: 3,
        datapointsToAlarm: 2
      });

      const slackIntegration = new CdkSlackChatBot(this, 'SlackIntegration', {
        topicName: 'slack-alarm',
        slackChannelId: 'xxx',
        slackWorkSpaceId: 'yyy',
        slackChannelConfigName: 'slack',
      });

      alarm.addAlarmAction(new cloudwatch_actions.SnsAction(slackIntegration.topic));
    }
  }
  ```

  Test Alarm:

  ```
  $ aws cloudwatch set-alarm-state --alarm-name "xxx" --state-value ALARM --state-reason "testing purposes"
  ```


pkgId: 4b65820e332d087c782d202f287965a2fe2c8c5d75e31d29424c2395eda2d9a2
name: python-cdk-sns-notify
arch: src
version: 0.0.948
epoch: 0
release: 1
summary: cdk-sns-notify
url: https://github.com/clarencetw/cdk-sns-notify.git
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-sns-notify-0.0.948-1.src.rpm
checksum_type: sha256
description:
  [![NPM version](https://badge.fury.io/js/cdk-sns-notify.svg)](https://badge.fury.io/js/cdk-sns-notify)
  [![PyPI version](https://badge.fury.io/py/cdk-sns-notify.svg)](https://badge.fury.io/py/cdk-sns-notify)
  ![Release](https://github.com/clarencetw/cdk-sns-notify/workflows/Release/badge.svg)



  A CDK construct library to send line notify or discord webhook



  ```python
  import * as sns from "@aws-cdk/aws-sns";
  import * as cloudwatch from "@aws-cdk/aws-cloudwatch";
  import * as cw_actions from "@aws-cdk/aws-cloudwatch-actions";

  import { SnsNotify } from "cdk-sns-notify";

  const topic = new sns.Topic(stack, "Topic");

  const metric = new cloudwatch.Metric({
    namespace: "AWS/EC2",
    metricName: "CPUUtilization",
    dimensions: {
      InstanceId: instance.instanceId,
    },
    period: cdk.Duration.minutes(1),
  });

  const alarm = new cloudwatch.Alarm(stack, "Alarm", {
    metric,
    threshold: 5,
    evaluationPeriods: 1,
  });

  alarm.addAlarmAction(new cw_actions.SnsAction(topic));

  const snsLineNotify = new SnsNotify(stack, "sns-line-notify", {
    lineNotifyToken: "lineNotifyToken",
  });

  topic.addSubscription(snsLineNotify.lambdaSubscription);
  ```



  ```sh
  cdk deploy
  ```


pkgId: 5840ef164a844c6f7773b34599f8d3b1f114264d902304955d9fec892fee0101
name: python-cdk-sops-secrets
arch: src
version: 1.13.3
epoch: 0
release: 1
summary: CDK Constructs that syncs your sops secrets into AWS SecretsManager secrets.
url: https://constructs.dev/packages/cdk-sops-secrets
rpm_license: Apache-2.0
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-cdk-sops-secrets-1.13.3-1.src.rpm
checksum_type: sha256
description:
  <img src="https://github.com/dbsystel/cdk-sops-secrets/blob/main/img/banner-dl-small.png?raw=true">
  <p/>

  ![stability](https://img.shields.io/badge/Stability-stable-green) 
  [![release](https://github.com/dbsystel/cdk-sops-secrets/actions/workflows/release.yml/badge.svg)](https://github.com/dbsystel/cdk-sops-secrets/actions/workflows/release.yml)<br>

  [![cdk-construct-hub](https://img.shields.io/badge/CDK-ConstructHub-blue)](https://constructs.dev/packages/cdk-sops-secrets)<br>
  [![npm](https://img.shields.io/npm/v/cdk-sops-secrets.svg)](https://www.npmjs.com/package/cdk-sops-secrets) 
  [![npm downloads](https://img.shields.io/npm/dw/cdk-sops-secrets)](https://www.npmjs.com/package/cdk-sops-secrets)<br>
  [![pypi](https://img.shields.io/pypi/v/cdk-sops-secrets.svg)](https://pypi.org/project/cdk-sops-secrets) 
  [![pypi downloads](https://img.shields.io/pypi/dw/cdk-sops-secrets)](https://pypi.org/project/cdk-sops-secrets)<br>

  [![codecov](https://codecov.io/gh/dbsystel/cdk-sops-secrets/branch/main/graph/badge.svg?token=OT7P7HQHXB)](https://codecov.io/gh/dbsystel/cdk-sops-secrets)  
  [![security-vulnerabilities](https://img.shields.io/github/issues-search/dbsystel/cdk-sops-secrets?color=%23ff0000&label=security-vulnerabilities&query=is%3Aissue%20is%3Aopen%20label%3A%22Mend%3A%20dependency%20security%20vulnerability%22)](https://github.com/dbsystel/cdk-sops-secrets/issues?q=is%3Aissue+is%3Aopen+label%3A%22security+vulnerability%22) 



  This construct library provides a replacement for CDK SecretsManager secrets, with extended functionality for Mozilla/sops.

  <p/><center><img src="img/flow.drawio.svg"></center><p/>
  Using this library it is possible to populate Secrets with values from a Mozilla/sops file without additional scripts and steps in the CI stage. Thereby transformations like JSON conversion of YAML files and transformation into a flat, JSONPath like structure will be performed, but can be disabled.

  Secrets filled in this way can be used immediately within the CloudFormation stack and dynamic references. This construct should handle all dependencies, if you use the `secretValueFromJson()` or `secretValue()` call to access secret values.

  This way, secrets can be securely stored in git repositories and easily synchronized into AWS SecretsManager secrets.



  You can consider this package as stable. Updates will follow [Semantic Versioning](https://semver.org/).<br>
  Nevertheless, I would recommend pinning the exact version of this library in your `package.json`.



  * [AWS](https://aws.amazon.com/): I think you already knew it, but this construct will only work with an AWS account.

  * [KMS Key](https://aws.amazon.com/kms/?nc1=h_ls): It makes most sense to encrypt your secrets with AWS KMS if you want to sync and use the secret content afterwards in your AWS account.
  * [mozilla/sops](https://github.com/mozilla/sops): This construct assumes that you store your secrets encrypted via sops in your git repository.
  * [CDK](https://aws.amazon.com/cdk/?nc1=h_ls): As this is a CDK construct, it's only useful if you use the CloudDevelopmentToolkit.



  1. Create a Mozilla/sops secrets file (encrypted with an already existing KMS key) and place it somewhere in your git repository
  2. Create a secret with the SopsSecret construct inside your app

     ```python
     const secret = new SopsSecret(stack, 'SopsComplexSecretJSON', {
       sopsFilePath: 'secets/sopsfile-encrypted.json',
     });
     ```
  3. Optional: Access the secret via dynamic references

     ```python
     secret.secretValueFromJson('json.path.dotted.notation.accessor[0]').toString(),
     ```



  Even if using the main functionality should be done in 3 lines of code, there are more options to configure the constructs of this library. If you want to get an Overview of all available configuration options take a look at the [documentation at the CDK ConstructHub](https://constructs.dev/packages/cdk-sops-secrets).

  The most useful settings will be explained in the further chapters:



  If you have the need to just upload a sops encrypted binary file, just name your sops encrypted file *.binary, or specify the option "binary" as format.

  ```python
  const secret = new SopsSecret(this, 'SopsComplexSecretJSON', {
    ...
    sopsFilePath: 'secrets/sopsfile-encrypted.binary',
  });
  ```

  or

  ```python
  const secret = new SopsSecret(this, 'SopsComplexSecretJSON', {
    ...
    sopsFilePath: 'secrets/sopsfile-encrypted.something',
    sopsFileFormat: 'binary',
  });
  ```



  While creating the secret or updating the entries of a secret, the native CDK function `cdk.FileSystem.fingerprint(...)` is used to generate the version information of the AWS SecretsManager secret.
  Therefore, it is possible to reference the entries from a specific AWS SecretsManager version.

  ```python
  const versionId = cdk.FileSystem.fingerprint(`./sops/SomeSecrets.json`)
  const passphrase = ecs.Secret.fromSecretsManagerVersion(secretMgmt, { versionId: versionId }, 'MY_PRIVATE_PASSPHRASE')

  const container = TaskDef.addContainer('Container', {
     secrets: {
       MY_PRIVATE_PASSPHRASE: passphrase,
     },
  });
  ```



  As default behavior, the SopsSecret (via the SopsSync) will convert all content to JSON and flatten its structure. This is useful, because the AWS SecretsManager has some limitations if it comes to YAML and/or complex objects and decimal values. Even if you can store YAML, complex objects and even binaries in AWS SecretsManager secrets, you can't access their values via the SecretsManager API — you can only return them as is. So accessing (nested) values or values from YAML files won't be possible via [dynamic references](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html) in CloudFormation (and CDK). That's why I decided that conversion to JSON, flatten the structure and stringify all values should be the default behavior. But you can turn off all of these conversion steps:

  ```python
  const secret = new SopsSecret(this, 'SopsComplexSecretJSON', {
    convertToJSON: false, // disable converting the encrypted content to JSON
    stringify: false, // disable stringifying all values
    flatten: false, // disable flattening of the object structure
    sopsFilePath: 'secrets/sopsfile-encrypted.json',
  });
  ```



  Sometimes it can be necessary to access the IAM role of the SopsSync provider. If this is the case, you should create the provider before creating the SopsSecret, and pass the provider to it like this:

  ```python
  // Create the provider
  const provider = new SopsSyncProvider(this, 'CustomSopsSyncProvider');
  // Grant whatever you need to the provider
  const myExtraKmsKey = Key.fromKeyArn(this, 'MyExtraKmsKey', 'YourKeyArn');
  myExtraKmsKey.grantDecrypt(provider);
  // create the secret and pass the the provider to it
  const secret = new SopsSecret(this, 'SopsComplexSecretJSON', {
    sopsProvider: provider,
    secretName: 'myCoolSecret',
    sopsFilePath: 'secrets/sopsfile-encrypted.json',
  });
  ```



  I decided, that the default behavior should be "INLINE" because of the following consideration:

  * Fewer permissions: If we use inline content instead of a S3 asset, the SopsSyncProvider does not need permissions to access the asset bucket and its KMS key.
  * Faster: If we don't have to upload and download things from and to S3, it should be a little faster.
  * Interchangeable: As we use the same information to generate the version of the secret, no new version of the secret should be created, if you change from INLINE to ASSET or vice versa, even if the CloudFormation resource updates.
  * I personally think sops files are not that big, that we should run into limits, but if so — we can change to asset `uploadType`.

  You can change the uplaodType via the properties:

  ```python
  const secret = new SopsSecret(this, 'SopsWithAssetUpload', {
    sopsFilePath: 'secrets/sopsfile-encrypted.json',
    uploadType: UploadType.ASSET, // instead of the default UploadType.INLINE
  });
  ```





  Even if this construct has some unit and integration tests performed, there can be bugs and issues. As everything is performed by a cloudformation custom resource provider, a good starting point is the log of the corresponding lambda function. It should be located in your AWS Account under Cloudwatch -> Log groups:

  `/aws/lambda/<YOUR-STACK-NAME>-SingletonLambdaSopsSyncProvider<SOMETHINGsomething1234>`



  Only very basic dotenv syntax is working right now. Only single line values are accepted. The format must match:

  ```dotenv
  key=value
  ```

  comments must be a single line, not after value assignments.



  This error message (and failed sync) is related to the  mozilla/sops issues [#948](https://github.com/mozilla/sops/issues/948) and [#634](https://github.com/mozilla/sops/issues/634). You must not create your secret with the `--aws-profile` flag. This profile will be written to your sops filed and is required in every runtime environment. You have to define the profile to use via the environment variable `AWS_PROFILE` instead, to avoid this.



  The lambda asset code is generated relative to the path of the index.ts in this package. With tools like nx this can lead to wrong results, so that the asset could not be found.

  You can override the asset path via the [cdk.json](https://docs.aws.amazon.com/cdk/v2/guide/get_context_var.html) or via the flag `-c`of the cdk cli.

  The context used for this override is `sops_sync_provider_asset_path`.

  So for example you can use

  ```bash
  cdk deploy -c "sops_sync_provider_asset_path=some/path/asset.zip"
  ```

  or in your cdk.json

  ```json
  {
    "context": {
      "sops_sync_provider_asset_path": "some/path/asset.zip"
    }
  }
  ```



  That's possible since version 1.8.0. You can reference the file in S3 like:

  ```python
  new SopsSecret(stack, 'SopsSecret', {
    sopsS3Bucket: 'testbucket',
    sopsS3Key: 'secret.json',
    sopsFileFormat: 'json',
    // ...
  });
  ```

  Passing those values as CloudFormation parameters should also be possible:

  ```python

  const sopsS3BucketParam = new CfnParameter(this, "s3BucketName", {
    type: "String",
    description: "The name of the Amazon S3 bucket where your sopsFile was uploaded."});

  const sopsS3KeyParam = new CfnParameter(this, "s3KeyName", {
    type: "String",
    description: "The name of the key of the sopsFile inside the Amazon S3 bucket."});

  new SopsSecret(stack, 'SopsSecret', {
    sopsS3Bucket: sopsS3BucketParam.valueAsString,
    sopsS3Key: sopsS3KeyParam.valueAsString,
    sopsFileFormat: 'json',
    // ...
  });
  ```



  I have created this project to solve a recurring problem of syncing Mozilla/sops secrets into AWS SecretsManager in a convenient, secure way.

  Other than that, or perhaps more importantly, my goal was to learn new things:

  * Write a Golang lambda
  * Writing unit tests incl. mocks in Golang
  * Reproducible builds of Golang binaries (byte-by-byte identical)
  * Build reproducible zips (byte-by-byte identical)
  * Release a NPM package
  * Setting up projects with projen
  * CI/CD with GitHub actions
  * CDK unit and integration tests



  The problem this Construct addresses is so good, already two other implementations exist:

  * [isotoma/sops-secretsmanager-cdk](https://github.com/isotoma/sops-secretsmanager-cdk): Does nearly the same. Uses CustomResource, wraps the sops CLI, does not support flatten. Found it after I published my solution to NPM :-/
  * [taimos/secretsmanager-versioning](https://github.com/taimos/secretsmanager-versioning): Different approach on the same problem. This is a CLI tool with very nice integration into CDK and also handles git versioning information.



  The Apache-2.0 license. Please have a look at the [LICENSE](LICENSE) and [LICENSE-3RD-PARTY](LICENSE-3RD-PARTY).


