Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
protected bound(_scope: Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
codepipeline.ActionConfig {
const createEvent = this.props.trigger === undefined ||
this.props.trigger === CodeCommitTrigger.EVENTS;
if (createEvent) {
this.props.repository.onCommit(stage.pipeline.node.uniqueId + 'EventRule', {
target: new targets.CodePipeline(stage.pipeline),
branches: [this.branch],
});
}
// the Action will write the contents of the Git repository to the Bucket,
// so its Role needs write permissions to the Pipeline Bucket
options.bucket.grantReadWrite(options.role);
// https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-acp
options.role.addToPolicy(new iam.PolicyStatement({
resources: [this.props.repository.repositoryArn],
actions: [
'codecommit:GetBranch',
'codecommit:GetCommit',
'codecommit:UploadArchive',
'codecommit:GetUploadArchiveStatus',
timeout: cdk.Duration.minutes(1),
environment: {
CHANGELOGS_TABLE_NAME: props.changelogsTable.tableName,
DISCOVERED_TOPIC_NAME: props.toCrawlTopic.topicArn
}
});
// Grant this application access to the DynamoDB table and SNS topic
props.changelogsTable.grantReadWriteData(rubygemFollower.role);
props.toCrawlTopic.grantPublish(rubygemFollower.role);
// Schedule the follower to run once every minute
this.eventRule = new events.Rule(this, 'check-recent-rubygems', {
schedule: events.Schedule.rate(cdk.Duration.minutes(5)),
targets: [
new targets.LambdaFunction(rubygemFollower)
]
});
}
}
code: lambda.Code.asset('./app/recently-crawled'),
environment: {
FEEDS_TABLE_NAME: props.feedsTable.tableName,
API_BUCKET_NAME: props.apiBucket.bucketName
}
});
// Grant the lambda permission to modify the tables and S3 bucket
props.feedsTable.grantReadWriteData(recentlyCrawled.role);
props.apiBucket.grantReadWrite(recentlyCrawled.role);
// Schedule the recrawler to run once every minute
this.eventRule = new events.Rule(this, 'recrawl-check-schedule', {
schedule: events.Schedule.rate(cdk.Duration.minutes(1)),
targets: [
new targets.LambdaFunction(recentlyCrawled)
]
});
}
}
CHANGELOGS_TABLE_NAME: props.changelogsTable.tableName,
FEEDS_TABLE_NAME: props.feedsTable.tableName,
WEB_BUCKET_NAME: props.webBucket.bucketName
}
});
// Grant the lambda permission to read the tables
props.feedsTable.grantReadData(regenerateHomepage.role);
props.changelogsTable.grantReadData(regenerateHomepage.role);
props.webBucket.grantReadWrite(regenerateHomepage.role);
// Schedule this lambda to run once a minute
this.eventRule = new events.Rule(this, 'homepage-regeneration-schedule', {
schedule: events.Schedule.rate(cdk.Duration.minutes(1)),
targets: [
new targets.LambdaFunction(regenerateHomepage)
]
});
}
}
timeout: cdk.Duration.minutes(5),
environment: {
CHANGELOGS_TABLE_NAME: props.changelogsTable.tableName,
DISCOVERED_TOPIC_NAME: props.toCrawlTopic.topicArn
}
});
// Grant the lambda permission to modify the tables
props.changelogsTable.grantReadWriteData(recrawlLambda.role);
props.toCrawlTopic.grantPublish(recrawlLambda.role);
// Schedule the recrawler to run once every minute
this.eventRule = new events.Rule(this, 'recrawl-check-schedule', {
schedule: events.Schedule.rate(cdk.Duration.minutes(1)),
targets: [
new targets.LambdaFunction(recrawlLambda)
]
});
}
}
}
});
if (config['output_s3_bucket'] == "default") {
// This is only used for the IAM policy, we leave this as *-* because there is not
// an easy way of figuring out the AWS account from within the CDK
config['output_s3_bucket'] = "aws-athena-query-results-*-*"
}
// Create rule to trigger this be run every 24 hours
new events.Rule(this, "scheduled_run", {
ruleName: "athena_partitioner_for_cloudtrail",
// Run at 10pm EST (midnight UTC) every night
schedule: events.Schedule.expression("cron(0 0 * * ? *)"),
description: "Starts the CloudMapper auditing task every night",
targets: [new targets.LambdaFunction(partitioner)]
});
// Grant access to Athena, Glue, and identifying the regions
partitioner.addToRolePolicy(new iam.PolicyStatement({
resources: ['*'],
actions: [
"athena:StartQueryExecution",
"athena:GetQueryExecution",
"athena:GetQueryResults",
"glue:BatchCreatePartition",
"glue:BatchGetPartition",
"glue:CreateTable",
"glue:CreateDatabase",
"glue:GetDatabase",
"glue:GetTable",
"glue:UpdateTable",
timeout: cdk.Duration.minutes(1),
environment: {
CHANGELOGS_TABLE_NAME: props.changelogsTable.tableName,
DISCOVERED_TOPIC_NAME: props.toCrawlTopic.topicArn
}
});
// Grant this application access to the DynamoDB table and SNS topic
props.changelogsTable.grantReadWriteData(pypiFollower.role);
props.toCrawlTopic.grantPublish(pypiFollower.role);
// Schedule the follower to run once every minute
this.eventRule = new events.Rule(this, 'check-recent-pypi', {
schedule: events.Schedule.rate(cdk.Duration.minutes(5)),
targets: [
new targets.LambdaFunction(pypiFollower)
]
});
}
}
protected bound(_scope: Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
codepipeline.ActionConfig {
if (this.props.trigger === S3Trigger.EVENTS) {
const id = stage.pipeline.node.uniqueId + 'SourceEventRule' + this.props.bucketKey;
if (this.props.bucket.node.tryFindChild(id)) {
// this means a duplicate path for the same bucket - error out
throw new Error(`S3 source action with path '${this.props.bucketKey}' is already present in the pipeline for this source bucket`);
}
this.props.bucket.onCloudTrailWriteObject(id, {
target: new targets.CodePipeline(stage.pipeline),
paths: [this.props.bucketKey]
});
}
// we need to read from the source bucket...
this.props.bucket.grantRead(options.role);
// ...and write to the Pipeline bucket
options.bucket.grantWrite(options.role);
return {
configuration: {
S3Bucket: this.props.bucket.bucketName,
S3ObjectKey: this.props.bucketKey,
PollForSourceChanges: this.props.trigger && this.props.trigger === S3Trigger.POLL,
},
protected bound(_scope: Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
codepipeline.ActionConfig {
options.role.addToPolicy(new iam.PolicyStatement({
actions: ['ecr:DescribeImages'],
resources: [this.props.repository.repositoryArn]
}));
this.props.repository.onCloudTrailImagePushed(stage.pipeline.node.uniqueId + 'SourceEventRule', {
target: new targets.CodePipeline(stage.pipeline),
imageTag: this.props.imageTag
});
// the Action Role also needs to write to the Pipeline's bucket
options.bucket.grantWrite(options.role);
return {
configuration: {
RepositoryName: this.props.repository.repositoryName,
ImageTag: this.props.imageTag,
},
};
}
}
// Run at 2am EST (6am UTC) every night
schedule: events.Schedule.expression("cron(0 6 * * ? *)"),
description: "Starts the CloudMapper auditing task every night",
targets: [new targets.EcsTask({
cluster: cluster,
taskDefinition: taskDefinition,
subnetSelection: {subnetType: ec2.SubnetType.PUBLIC}
})]
});
// Create rule to trigger this manually
new events.Rule(this, "manual_run", {
ruleName: "cloudmapper_manual_run",
eventPattern: {source: ['cloudmapper']},
description: "Allows CloudMapper auditing to be manually started",
targets: [new targets.EcsTask({
cluster: cluster,
taskDefinition: taskDefinition,
subnetSelection: {subnetType: ec2.SubnetType.PUBLIC}
})]
});
// Create alarm for any errors
const error_alarm = new cloudwatch.Alarm(this, "error_alarm", {
metric: new cloudwatch.Metric({
namespace: 'cloudmapper',
metricName: "errors",
statistic: "Sum"
}),
threshold: 0,
evaluationPeriods: 1,
datapointsToAlarm: 1,