Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
handler: 'pypi-recent.handle',
code: lambda.Code.asset('./app/pypi-recent'),
timeout: cdk.Duration.minutes(1),
environment: {
CHANGELOGS_TABLE_NAME: props.changelogsTable.tableName,
DISCOVERED_TOPIC_NAME: props.toCrawlTopic.topicArn
}
});
// Grant this application access to the DynamoDB table and SNS topic
props.changelogsTable.grantReadWriteData(pypiFollower.role);
props.toCrawlTopic.grantPublish(pypiFollower.role);
// Schedule the follower to run once every minute
this.eventRule = new events.Rule(this, 'check-recent-pypi', {
schedule: events.Schedule.rate(cdk.Duration.minutes(5)),
targets: [
new targets.LambdaFunction(pypiFollower)
]
});
}
}
"DATABASE": config["database"],
"TABLE_PREFIX": config["table_prefix"]
}
});
if (config['output_s3_bucket'] == "default") {
// This is only used for the IAM policy, we leave this as *-* because there is not
// an easy way of figuring out the AWS account from within the CDK
config['output_s3_bucket'] = "aws-athena-query-results-*-*"
}
// Create rule to trigger this be run every 24 hours
new events.Rule(this, "scheduled_run", {
ruleName: "athena_partitioner_for_cloudtrail",
// Run at 10pm EST (midnight UTC) every night
schedule: events.Schedule.expression("cron(0 0 * * ? *)"),
description: "Starts the CloudMapper auditing task every night",
targets: [new targets.LambdaFunction(partitioner)]
});
// Grant access to Athena, Glue, and identifying the regions
partitioner.addToRolePolicy(new iam.PolicyStatement({
resources: ['*'],
actions: [
"athena:StartQueryExecution",
"athena:GetQueryExecution",
"athena:GetQueryResults",
"glue:BatchCreatePartition",
"glue:BatchGetPartition",
"glue:CreateTable",
"glue:CreateDatabase",
"glue:GetDatabase",
actions: ['cloudwatch:PutMetricData']
}));
// Grant the ability to read from Secrets Manager
taskDefinition.addToTaskRolePolicy(new iam.PolicyStatement({
// This IAM privilege has no paths or conditions
resources: ["*"],
actions: ['secretsmanager:GetSecretValue'],
conditions: {'ForAnyValue:StringLike':{'secretsmanager:SecretId': '*cloudmapper-slack-webhook*'}}
}));
// Create rule to trigger this be run every 24 hours
new events.Rule(this, "scheduled_run", {
ruleName: "cloudmapper_scheduler",
// Run at 2am EST (6am UTC) every night
schedule: events.Schedule.expression("cron(0 6 * * ? *)"),
description: "Starts the CloudMapper auditing task every night",
targets: [new targets.EcsTask({
cluster: cluster,
taskDefinition: taskDefinition,
subnetSelection: {subnetType: ec2.SubnetType.PUBLIC}
})]
});
// Create rule to trigger this manually
new events.Rule(this, "manual_run", {
ruleName: "cloudmapper_manual_run",
eventPattern: {source: ['cloudmapper']},
description: "Allows CloudMapper auditing to be manually started",
targets: [new targets.EcsTask({
cluster: cluster,
taskDefinition: taskDefinition,