@studion/infra-code-blocks/dist/components/database/ec2-ssm-connect.js

Studion common infra components

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.Ec2SSMConnect = void 0;
const aws = require("@pulumi/aws");
const pulumi = require("@pulumi/pulumi");
const common_tags_1 = require("../../shared/common-tags");
const merge_with_defaults_1 = require("../../shared/merge-with-defaults");
const resolve_aws_region_1 = require("../../shared/resolve-aws-region");
const defaults = {
    instanceType: 't4g.nano',
};
class Ec2SSMConnect extends pulumi.ComponentResource {
    name;
    ec2SecurityGroup;
    role;
    ssmProfile;
    ssmVpcEndpoint;
    ec2MessagesVpcEndpoint;
    ssmMessagesVpcEndpoint;
    ec2;
    amiResult;
    constructor(name, args, opts = {}) {
        super('studion:database:Ec2SSMConnect', name, {}, {
            ...opts,
            aliases: [
                ...(opts.aliases || []),
                { type: 'studion:Ec2BastionSSMConnect' },
            ],
        });
        const { vpc, ami, instanceType, tags } = (0, merge_with_defaults_1.mergeWithDefaults)(defaults, args);
        this.name = name;
        const vpcOutput = pulumi.output(vpc);
        const region = (0, resolve_aws_region_1.resolveAwsRegion)(args, this);
        const subnetId = vpcOutput.privateSubnetIds.apply(ids => ids[0]);
        const amiId = ami ??
            (this.amiResult = aws.ec2.getAmiOutput({
                filters: [
                    { name: 'architecture', values: ['arm64'] },
                    { name: 'root-device-type', values: ['ebs'] },
                    { name: 'virtualization-type', values: ['hvm'] },
                    { name: 'ena-support', values: ['true'] },
                ],
                owners: ['amazon'],
                nameRegex: 'al2023-ami-2023\.[0-9]+\.[0-9]+\.[0-9]+-kernel-[0-9]+\.[0-9]+-arm64',
                mostRecent: true,
            })).id;
        this.ec2SecurityGroup = new aws.ec2.SecurityGroup(`${this.name}-ec2-security-group`, {
            ingress: [
                {
                    protocol: 'tcp',
                    fromPort: 22,
                    toPort: 22,
                    cidrBlocks: [vpcOutput.vpc.cidrBlock],
                },
                {
                    protocol: 'tcp',
                    fromPort: 443,
                    toPort: 443,
                    cidrBlocks: [vpcOutput.vpc.cidrBlock],
                },
            ],
            egress: [
                { protocol: '-1', fromPort: 0, toPort: 0, cidrBlocks: ['0.0.0.0/0'] },
            ],
            vpcId: vpcOutput.vpcId,
            tags: common_tags_1.commonTags,
        }, { parent: this });
        this.role = new aws.iam.Role(`${this.name}-ec2-role`, {
            assumeRolePolicy: {
                Version: '2012-10-17',
                Statement: [
                    {
                        Effect: 'Allow',
                        Principal: {
                            Service: 'ec2.amazonaws.com',
                        },
                        Action: 'sts:AssumeRole',
                    },
                ],
            },
            tags: common_tags_1.commonTags,
        }, { parent: this });
        const ssmPolicyAttachment = new aws.iam.RolePolicyAttachment(`${this.name}-ssm-policy-attachment`, {
            role: this.role.name,
            policyArn: 'arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore',
        }, { parent: this });
        this.ssmProfile = new aws.iam.InstanceProfile(`${this.name}-ssm-profile`, {
            role: this.role.name,
            tags: common_tags_1.commonTags,
        }, { parent: this, dependsOn: [ssmPolicyAttachment] });
        this.ec2 = new aws.ec2.Instance(`${this.name}-ec2`, {
            ami: amiId,
            associatePublicIpAddress: false,
            instanceType,
            iamInstanceProfile: this.ssmProfile.name,
            subnetId,
            vpcSecurityGroupIds: [this.ec2SecurityGroup.id],
            tags: {
                ...common_tags_1.commonTags,
                Name: `${this.name}-ec2`,
                ...tags,
            },
        }, { parent: this });
        this.ssmVpcEndpoint = new aws.ec2.VpcEndpoint(`${this.name}-ssm-vpc-endpoint`, {
            vpcId: vpcOutput.vpcId,
            ipAddressType: 'ipv4',
            serviceName: pulumi.interpolate `com.amazonaws.${region}.ssm`,
            vpcEndpointType: 'Interface',
            subnetIds: [subnetId],
            securityGroupIds: [this.ec2SecurityGroup.id],
            privateDnsEnabled: true,
            tags: common_tags_1.commonTags,
        }, { parent: this, dependsOn: [this.ec2] });
        this.ec2MessagesVpcEndpoint = new aws.ec2.VpcEndpoint(`${this.name}-ec2messages-vpc-endpoint`, {
            vpcId: vpcOutput.vpcId,
            ipAddressType: 'ipv4',
            serviceName: pulumi.interpolate `com.amazonaws.${region}.ec2messages`,
            vpcEndpointType: 'Interface',
            subnetIds: [subnetId],
            securityGroupIds: [this.ec2SecurityGroup.id],
            privateDnsEnabled: true,
            tags: common_tags_1.commonTags,
        }, { parent: this, dependsOn: [this.ec2] });
        this.ssmMessagesVpcEndpoint = new aws.ec2.VpcEndpoint(`${this.name}-ssmmessages-vpc-endpoint`, {
            vpcId: vpcOutput.vpcId,
            ipAddressType: 'ipv4',
            serviceName: pulumi.interpolate `com.amazonaws.${region}.ssmmessages`,
            vpcEndpointType: 'Interface',
            subnetIds: [subnetId],
            securityGroupIds: [this.ec2SecurityGroup.id],
            privateDnsEnabled: true,
            tags: common_tags_1.commonTags,
        }, { parent: this, dependsOn: [this.ec2] });
        this.registerOutputs();
    }
}
exports.Ec2SSMConnect = Ec2SSMConnect;