Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
"02_config-amazon-cloudwatch-agent": {
"files": {
'/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json': {
"content": cf.join("\n", [
"{\"logs\": {",
"\"logs_collected\": {",
"\"files\": {",
"\"collect_list\": [",
"{",
"\"file_path\": \"/opt/aws/amazon-cloudwatch-agent/logs/amazon-cloudwatch-agent.log\",",
cf.sub("\"log_group_name\": \"${AWS::StackName}.log\","),
cf.sub("\"log_stream_name\": \"${AWS::StackName}-cloudwatch-agent.log\","),
"\"timezone\": \"UTC\"",
"},",
"{",
cf.sub("\"file_path\": \"${TaskingManagerLogDirectory}/tasking-manager.log\","),
cf.sub("\"log_group_name\": \"${AWS::StackName}.log\","),
cf.sub("\"log_stream_name\": \"${AWS::StackName}.log\","),
"\"timezone\": \"UTC\"",
"}]}},",
cf.sub("\"log_stream_name\": \"${AWS::StackName}-logs\","),
"\"force_flush_interval\" : 15",
"}}"
])
}
}
},
// Invoke amazon-cloudwatch-agent-ctl to restart the AmazonCloudWatchAgent.
"03_restart_amazon-cloudwatch-agent": {
"commands": {
"01_stop_service": {
"command": "/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a stop"
const PassthroughFunction = (lambda, prefix) => ({
Type: 'AWS::Lambda::Function',
Properties: {
Code: {
ZipFile: cf.join('\n', [
'"use strict";',
'const AWS = require("aws-sdk");',
cf.sub('const lambda = new AWS.Lambda({ region: "${AWS::Region}" });'),
'module.exports.lambda = (event, context, callback) => {',
' if (event.httpMethod === "OPTIONS") {',
' const requestHeaders = event.headers["Access-Control-Request-Headers"]',
' || event.headers["access-control-request-headers"];',
' const response = {',
' statusCode: 200,',
' body: "",',
' headers: {',
' "Access-Control-Allow-Headers": requestHeaders,',
' "Access-Control-Allow-Methods": "POST, OPTIONS",',
' "Access-Control-Allow-Origin": "*"',
' }',
' };',
' callback(null, response);',
' return;',
' }',
cf.sub('export TM_SMTP_HOST="${TaskingManagerSMTPHost}"'),
cf.sub('export TM_SMTP_PASSWORD="${TaskingManagerSMTPPassword}"'),
cf.sub('export TM_SMTP_PORT="${TaskingManagerSMTPPort}"'),
cf.sub('export TM_SMTP_USER="${TaskingManagerSMTPUser}"'),
cf.sub('export TM_DEFAULT_CHANGESET_COMMENT="${TaskingManagerDefaultChangesetComment}"'),
cf.sub('export TM_MATOMO_ID="${MatomoSiteID}"'),
cf.sub('export TM_MATOMO_ENDPOINT="${MatomoEndpoint}"'),
cf.sub('export TM_MAPBOX_TOKEN="${MapboxToken}"'),
cf.sub('export TM_ORG_NAME="${OrgName}"'),
cf.sub('export TM_ORG_CODE="${OrgCode}"'),
cf.sub('export TM_ORG_URL="${OrgUrl}"'),
cf.sub('export TM_ORG_PRIVACY_POLICY="${OrgPrivacyPolicy}"'),
cf.sub('export TM_ORG_TWITTER="${OrgTwitter}"'),
cf.sub('export TM_ORG_FB="${OrgFacebook}"'),
cf.sub('export TM_ORG_INSTAGRAM="${OrgInstagram}"'),
cf.sub('export TM_ORG_YOUTUBE="${OrgYoutube}"'),
cf.sub('export TM_ORG_GITHUB="${OrgGitHub}"'),
'psql "host=$POSTGRES_ENDPOINT dbname=$POSTGRES_DB user=$POSTGRES_USER password=$POSTGRES_PASSWORD" -c "CREATE EXTENSION IF NOT EXISTS postgis"',
cf.if('DatabaseDumpFileGiven', cf.sub('aws s3 cp ${DatabaseDump} dump.sql; sudo -u postgres psql "postgresql://$POSTGRES_USER:$POSTGRES_PASSWORD@$POSTGRES_ENDPOINT/$POSTGRES_DB" < dump.sql'), ''),
'./venv/bin/python3.6 manage.py db upgrade',
'cd frontend/',
'npm install',
'npm run build',
'cd ../',
'echo "------------------------------------------------------------"',
'gunicorn -b 0.0.0.0:8000 --worker-class gevent --workers 3 --threads 3 --timeout 179 manage:application &',
cf.sub('sudo cfn-init -v --stack ${AWS::StackName} --resource TaskingManagerLaunchConfiguration --region ${AWS::Region} --configsets default'),
cf.sub('cfn-signal --exit-code $? --region ${AWS::Region} --resource TaskingManagerASG --stack ${AWS::StackName}')
]),
KeyName: 'mbtiles'
}
},
'. ./venv/bin/activate',
'pip install --upgrade pip',
'pip install -r requirements.txt',
'echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf',
'export LC_ALL=C',
'wget https://s3.amazonaws.com/amazoncloudwatch-agent/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb -O /tmp/amazon-cloudwatch-agent.deb',
'dpkg -i /tmp/amazon-cloudwatch-agent.deb',
'wget https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-latest.tar.gz',
'pip2 install aws-cfn-bootstrap-latest.tar.gz',
'echo "Exporting environment variables:"',
cf.sub('export NEW_RELIC_LICENSE=${NewRelicLicense}'),
cf.join('', ['export POSTGRES_ENDPOINT=', cf.getAtt('TaskingManagerRDS','Endpoint.Address')]),
cf.sub('export POSTGRES_DB=${PostgresDB}'),
cf.sub('export POSTGRES_PASSWORD="${PostgresPassword}"'),
cf.sub('export POSTGRES_USER="${PostgresUser}"'),
cf.sub('export TM_APP_BASE_URL="${TaskingManagerAppBaseUrl}"'),
cf.sub('export TM_CONSUMER_KEY="${TaskingManagerConsumerKey}"'),
cf.sub('export TM_CONSUMER_SECRET="${TaskingManagerConsumerSecret}"'),
cf.sub('export TM_EMAIL_FROM_ADDRESS="${TaskingManagerEmailFromAddress}"'),
cf.sub('export TM_LOG_DIR="${TaskingManagerLogDirectory}"'),
cf.sub('export TM_SECRET="${TaskingManagerSecret}"'),
cf.sub('export TM_SMTP_HOST="${TaskingManagerSMTPHost}"'),
cf.sub('export TM_SMTP_PASSWORD="${TaskingManagerSMTPPassword}"'),
cf.sub('export TM_SMTP_PORT="${TaskingManagerSMTPPort}"'),
cf.sub('export TM_SMTP_USER="${TaskingManagerSMTPUser}"'),
cf.sub('export TM_DEFAULT_CHANGESET_COMMENT="${TaskingManagerDefaultChangesetComment}"'),
cf.sub('export TM_MATOMO_ID="${MatomoSiteID}"'),
cf.sub('export TM_MATOMO_ENDPOINT="${MatomoEndpoint}"'),
cf.sub('export TM_MAPBOX_TOKEN="${MapboxToken}"'),
cf.sub('export TM_ORG_NAME="${OrgName}"'),
cf.sub('export TM_ORG_CODE="${OrgCode}"'),
cf.sub('export TM_ORG_URL="${OrgUrl}"'),
'echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf',
'export LC_ALL=C',
'wget https://s3.amazonaws.com/amazoncloudwatch-agent/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb -O /tmp/amazon-cloudwatch-agent.deb',
'dpkg -i /tmp/amazon-cloudwatch-agent.deb',
'wget https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-latest.tar.gz',
'pip2 install aws-cfn-bootstrap-latest.tar.gz',
'echo "Exporting environment variables:"',
cf.sub('export NEW_RELIC_LICENSE=${NewRelicLicense}'),
cf.join('', ['export POSTGRES_ENDPOINT=', cf.getAtt('TaskingManagerRDS','Endpoint.Address')]),
cf.sub('export POSTGRES_DB=${PostgresDB}'),
cf.sub('export POSTGRES_PASSWORD="${PostgresPassword}"'),
cf.sub('export POSTGRES_USER="${PostgresUser}"'),
cf.sub('export TM_APP_BASE_URL="${TaskingManagerAppBaseUrl}"'),
cf.sub('export TM_CONSUMER_KEY="${TaskingManagerConsumerKey}"'),
cf.sub('export TM_CONSUMER_SECRET="${TaskingManagerConsumerSecret}"'),
cf.sub('export TM_EMAIL_FROM_ADDRESS="${TaskingManagerEmailFromAddress}"'),
cf.sub('export TM_LOG_DIR="${TaskingManagerLogDirectory}"'),
cf.sub('export TM_SECRET="${TaskingManagerSecret}"'),
cf.sub('export TM_SMTP_HOST="${TaskingManagerSMTPHost}"'),
cf.sub('export TM_SMTP_PASSWORD="${TaskingManagerSMTPPassword}"'),
cf.sub('export TM_SMTP_PORT="${TaskingManagerSMTPPort}"'),
cf.sub('export TM_SMTP_USER="${TaskingManagerSMTPUser}"'),
cf.sub('export TM_DEFAULT_CHANGESET_COMMENT="${TaskingManagerDefaultChangesetComment}"'),
cf.sub('export TM_MATOMO_ID="${MatomoSiteID}"'),
cf.sub('export TM_MATOMO_ENDPOINT="${MatomoEndpoint}"'),
cf.sub('export TM_MAPBOX_TOKEN="${MapboxToken}"'),
cf.sub('export TM_ORG_NAME="${OrgName}"'),
cf.sub('export TM_ORG_CODE="${OrgCode}"'),
cf.sub('export TM_ORG_URL="${OrgUrl}"'),
cf.sub('export TM_ORG_PRIVACY_POLICY="${OrgPrivacyPolicy}"'),
cf.sub('export TM_ORG_TWITTER="${OrgTwitter}"'),
cf.sub('export TM_ORG_FB="${OrgFacebook}"'),
Timeout: 300,
Handler: 'lambda.gatekeeper',
MemorySize: 128,
Role: cf.getAtt('GatekeeperLambdaRole', 'Arn'),
Environment: {
Variables: {
GITHUB_ACCESS_TOKEN: cf.ref('GithubAccessToken'),
GITHUB_APP_INSTALLATION_ID: cf.ref('GithubAppInstallationId')
}
}
}
},
GatekeeperLambdaErrorAlarm: {
Type: 'AWS::CloudWatch::Alarm',
Properties: {
AlarmName: cf.sub('${AWS::StackName}-gatekeeper-function-errors'),
Period: 60,
EvaluationPeriods: 5,
Statistic: 'Sum',
Threshold: 0,
ComparisonOperator: 'GreaterThanThreshold',
TreatMissingData: 'notBreaching',
Namespace: 'AWS/Lambda',
Dimensions: [
{ Name: 'FunctionName', Value: cf.ref('GatekeeperLambda') }
],
MetricName: 'Errors',
AlarmActions: [cf.ref('AlarmSNSTopic')]
}
}
};
},
PipelineRole: {
Type: 'AWS::IAM::Role',
Properties: {
AssumeRolePolicyDocument: {
Statement: [
{
Effect: 'Allow',
Action: 'sts:AssumeRole',
Principal: { Service: 'codepipeline.amazonaws.com' }
}
]
},
Policies: [
{
PolicyName: cf.sub('PipelinePolicy'),
PolicyDocument: {
Statement: [
{
Effect: 'Allow',
Action: [
's3:ListBucket',
's3:GetBucketVersioning',
's3:GetObject',
's3:GetObjectVersion',
's3:PutObject'
],
Resource: [
cf.sub('arn:${AWS::Partition}:s3:::watchbot-binaries'),
cf.sub('arn:${AWS::Partition}:s3:::watchbot-binaries/*')
]
},
' return context.done(null, "Ignored unparseable event from Github");',
' }',
' var params = {',
' TopicArn: topic,',
' Subject: "webhook",',
' Message: JSON.stringify(push)',
' };',
' sns.publish(params, function(err) {',
' if (err) return context.done("error: " + err.message);',
' context.done(null, "success");',
' });',
'};'
])
},
Role: cf.getAtt(`${prefix}FunctionRole`, 'Arn'),
Description: cf.sub('Github webhook for ${AWS::StackName}'),
Handler: 'index.webhooks',
Runtime: 'nodejs6.10',
Timeout: 30,
MemorySize: 128
}
});
PolicyName: 'stork-projects',
PolicyDocument: {
Statement: [
{
Effect: 'Allow',
Action: [
'logs:CreateLogGroup',
'logs:CreateLogStream',
'logs:PutLogEvents'
],
Resource: cf.sub('arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*')
},
{
Effect: 'Allow',
Action: 's3:PutObject',
Resource: cf.sub('arn:aws:s3:::${OutputBucketPrefix}-${AWS::Region}/${OutputKeyPrefix}/*')
},
{
Effect: 'Allow',
Action: [
'ecr:GetDownloadUrlForLayer',
'ecr:BatchGetImage',
'ecr:BatchCheckLayerAvailability'
],
Resource: '*'
},
{
Effect: 'Allow',
Action: 'kms:Decrypt',
Resource: cf.importValue('cloudformation-kms-production')
}
]
cf.sub('git reset --hard ${GitSha}'),
'python3.6 -m venv ./venv',
'. ./venv/bin/activate',
'pip install --upgrade pip',
'pip install -r requirements.txt',
'echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf',
'export LC_ALL=C',
'wget https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-latest.tar.gz',
'pip2 install aws-cfn-bootstrap-latest.tar.gz',
'echo "Exporting environment variables:"',
cf.sub('export NEW_RELIC_LICENSE=${NewRelicLicense}'),
cf.join('', ['export POSTGRES_ENDPOINT=', cf.if('UsePostgresEndpoint', cf.ref('PostgresEndpoint'), cf.getAtt('TaskingManagerRDS', 'Endpoint.Address'))]),
cf.sub('export POSTGRES_DB=${PostgresDB}'),
cf.sub('export POSTGRES_PASSWORD="${PostgresPassword}"'),
cf.sub('export POSTGRES_USER="${PostgresUser}"'),
cf.sub('export TM_APP_BASE_URL="${TaskingManagerAppBaseUrl}"'),
cf.sub('export TM_CONSUMER_KEY="${TaskingManagerConsumerKey}"'),
cf.sub('export TM_CONSUMER_SECRET="${TaskingManagerConsumerSecret}"'),
cf.sub('export TM_EMAIL_FROM_ADDRESS="${TaskingManagerEmailFromAddress}"'),
cf.sub('export TM_LOG_DIR="${TaskingManagerLogDirectory}"'),
cf.sub('export TM_SECRET="${TaskingManagerSecret}"'),
cf.sub('export TM_SMTP_HOST="${TaskingManagerSMTPHost}"'),
cf.sub('export TM_SMTP_PASSWORD="${TaskingManagerSMTPPassword}"'),
cf.sub('export TM_SMTP_PORT="${TaskingManagerSMTPPort}"'),
cf.sub('export TM_SMTP_USER="${TaskingManagerSMTPUser}"'),
cf.if('DatabaseDumpFileGiven', cf.sub('aws s3 cp ${DatabaseDump} dump.sql; psql "postgresql://$POSTGRES_USER:$POSTGRES_PASSWORD@$POSTGRES_ENDPOINT/$POSTGRES_DB" -f dump.sql'), ''),
'./venv/bin/python3.6 manage.py db upgrade',
'cd client/',
'npm install',
'gulp build',
'cd ../',
'echo "------------------------------------------------------------"',