Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
taskDefinition.addToTaskRolePolicy(new iam.PolicyStatement({
// This IAM privilege has no paths or conditions
resources: ["*"],
actions: ['cloudwatch:PutMetricData']
}));
// Grant the ability to read from Secrets Manager
taskDefinition.addToTaskRolePolicy(new iam.PolicyStatement({
// This IAM privilege has no paths or conditions
resources: ["*"],
actions: ['secretsmanager:GetSecretValue'],
conditions: {'ForAnyValue:StringLike':{'secretsmanager:SecretId': '*cloudmapper-slack-webhook*'}}
}));
// Create rule to trigger this be run every 24 hours
new events.Rule(this, "scheduled_run", {
ruleName: "cloudmapper_scheduler",
// Run at 2am EST (6am UTC) every night
schedule: events.Schedule.expression("cron(0 6 * * ? *)"),
description: "Starts the CloudMapper auditing task every night",
targets: [new targets.EcsTask({
cluster: cluster,
taskDefinition: taskDefinition,
subnetSelection: {subnetType: ec2.SubnetType.PUBLIC}
})]
});
// Create rule to trigger this manually
new events.Rule(this, "manual_run", {
ruleName: "cloudmapper_manual_run",
eventPattern: {source: ['cloudmapper']},
description: "Allows CloudMapper auditing to be manually started",
constructor(scope: Construct, id: string, props: ScheduledTaskBaseProps) {
super(scope, id);
this.cluster = props.cluster || this.getDefaultCluster(this, props.vpc);
this.desiredTaskCount = props.desiredTaskCount || 1;
// An EventRule that describes the event trigger (in this case a scheduled run)
this.eventRule = new Rule(this, 'ScheduledEventRule', {
schedule: props.schedule,
});
this.logDriver = props.logDriver !== undefined
? props.logDriver
: this.createAWSLogDriver(this.node.id);
}
runtime: lambda.Runtime.NODEJS_10_X,
handler: 'recrawl.handle',
code: lambda.Code.asset('./app/recrawl'),
timeout: cdk.Duration.minutes(5),
environment: {
CHANGELOGS_TABLE_NAME: props.changelogsTable.tableName,
DISCOVERED_TOPIC_NAME: props.toCrawlTopic.topicArn
}
});
// Grant the lambda permission to modify the tables
props.changelogsTable.grantReadWriteData(recrawlLambda.role);
props.toCrawlTopic.grantPublish(recrawlLambda.role);
// Schedule the recrawler to run once every minute
this.eventRule = new events.Rule(this, 'recrawl-check-schedule', {
schedule: events.Schedule.rate(cdk.Duration.minutes(1)),
targets: [
new targets.LambdaFunction(recrawlLambda)
]
});
}
}
runtime: lambda.Runtime.NODEJS_10_X,
handler: 'rubygem-recent.handle',
code: lambda.Code.asset('./app/rubygem-recent'),
timeout: cdk.Duration.minutes(1),
environment: {
CHANGELOGS_TABLE_NAME: props.changelogsTable.tableName,
DISCOVERED_TOPIC_NAME: props.toCrawlTopic.topicArn
}
});
// Grant this application access to the DynamoDB table and SNS topic
props.changelogsTable.grantReadWriteData(rubygemFollower.role);
props.toCrawlTopic.grantPublish(rubygemFollower.role);
// Schedule the follower to run once every minute
this.eventRule = new events.Rule(this, 'check-recent-rubygems', {
schedule: events.Schedule.rate(cdk.Duration.minutes(5)),
targets: [
new targets.LambdaFunction(rubygemFollower)
]
});
}
}
runtime: lambda.Runtime.NODEJS_10_X,
handler: 'pypi-recent.handle',
code: lambda.Code.asset('./app/pypi-recent'),
timeout: cdk.Duration.minutes(1),
environment: {
CHANGELOGS_TABLE_NAME: props.changelogsTable.tableName,
DISCOVERED_TOPIC_NAME: props.toCrawlTopic.topicArn
}
});
// Grant this application access to the DynamoDB table and SNS topic
props.changelogsTable.grantReadWriteData(pypiFollower.role);
props.toCrawlTopic.grantPublish(pypiFollower.role);
// Schedule the follower to run once every minute
this.eventRule = new events.Rule(this, 'check-recent-pypi', {
schedule: events.Schedule.rate(cdk.Duration.minutes(5)),
targets: [
new targets.LambdaFunction(pypiFollower)
]
});
}
}
public onEvent(id: string, options: events.OnEventOptions = {}): events.Rule {
const rule = new events.Rule(this, id, options);
rule.addTarget(options.target);
rule.addEventPattern({
source: ['aws.codebuild'],
detail: {
'project-name': [this.projectName]
}
});
return rule;
}
public onCloudTrailEvent(id: string, options: events.OnEventOptions = {}): events.Rule {
const rule = new events.Rule(this, id, options);
rule.addTarget(options.target);
rule.addEventPattern({
detailType: ['AWS API Call via CloudTrail']
});
return rule;
}
}