Skip to content

feat(core): PHZ-Resolver-Rules-Worldwide #395

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Sep 18, 2020
Merged

feat(core): PHZ-Resolver-Rules-Worldwide #395

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
802db45
fix(core): Creating Resolvers anywhere and sharing rules (#389)
naveenkoppula Sep 15, 2020
ff89604
fix(core): z131 vpc flow log permissions issue (#384)
nachundu-amzn Sep 15, 2020
8bd754a
Latest config handling
naveenkoppula Sep 15, 2020
0530620
updated security group name
nachundu-amzn Sep 15, 2020
db3ab08
narrow down the access to account id level
nachundu-amzn Sep 16, 2020
b1b0b53
skip deletion of bucket policy in security account
nachundu-amzn Sep 16, 2020
f10ecf5
fix(core): PhZ-resolver-rules (#393)
naveenkoppula Sep 18, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions reference-artifacts/config.ALZ.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,14 +83,15 @@
"report-versioning": "OVERWRITE_REPORT"
}
},
"zones": {
"zones": [{
"account": "shared-network",
"resolver-vpc": "Endpoint",
"region": "ca-central-1",
"names": {
"public": ["dept.cloud-nuage.canada.ca"],
"private": ["dept.cloud-nuage.gc.ca"]
}
},
}],
"vpc-flow-logs": {
"filter": "ALL",
"interval": 60,
Expand Down
5 changes: 3 additions & 2 deletions reference-artifacts/config.example.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,14 +83,15 @@
"report-versioning": "OVERWRITE_REPORT"
}
},
"zones": {
"zones": [{
"account": "shared-network",
"resolver-vpc": "Endpoint",
"region": "ca-central-1",
"names": {
"public": ["dept.cloud-nuage.canada.ca"],
"private": ["dept.cloud-nuage.gc.ca"]
}
},
}],
"vpc-flow-logs": {
"filter": "ALL",
"interval": 60,
Expand Down
99 changes: 69 additions & 30 deletions src/core/cdk/src/initial-setup.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,7 @@ export namespace InitialSetup {
functionPayload: {
'inputConfig.$': '$',
region: cdk.Aws.REGION,
'baseline.$': '$.configuration.baseline',
'baseline.$': '$.configuration.baselineOutput.baseline',
},
resultPath: 'DISCARD',
});
Expand All @@ -174,8 +174,9 @@ export namespace InitialSetup {
'configFilePath.$': '$.configuration.configFilePath',
'configCommitId.$': '$.configuration.configCommitId',
'acceleratorVersion.$': '$.configuration.acceleratorVersion',
outputTableName: outputsTable.tableName,
},
resultPath: '$.configuration.baseline',
resultPath: '$.configuration.baselineOutput',
});

const loadLandingZoneConfigurationTask = new CodeTask(this, 'Load Landing Zone Configuration', {
Expand All @@ -188,7 +189,9 @@ export namespace InitialSetup {
configRepositoryName: props.configRepositoryName,
'configFilePath.$': '$.configuration.configFilePath',
'configCommitId.$': '$.configuration.configCommitId',
'baseline.$': '$.configuration.baseline',
'baseline.$': '$.configuration.baselineOutput.baseline',
'storeAllOutputs.$': '$.configuration.baselineOutput.storeAllOutputs',
'phases.$': '$.configuration.baselineOutput.phases',
'acceleratorVersion.$': '$.configuration.acceleratorVersion',
'configRootFilePath.$': '$.configuration.configRootFilePath',
},
Expand All @@ -205,7 +208,9 @@ export namespace InitialSetup {
configRepositoryName: props.configRepositoryName,
'configFilePath.$': '$.configuration.configFilePath',
'configCommitId.$': '$.configuration.configCommitId',
'baseline.$': '$.configuration.baseline',
'baseline.$': '$.configuration.baselineOutput.baseline',
'storeAllOutputs.$': '$.configuration.baselineOutput.storeAllOutputs',
'phases.$': '$.configuration.baselineOutput.phases',
'acceleratorVersion.$': '$.configuration.acceleratorVersion',
'configRootFilePath.$': '$.configuration.configRootFilePath',
},
Expand Down Expand Up @@ -332,6 +337,8 @@ export namespace InitialSetup {
'configCommitId.$': '$.configuration.configCommitId',
'acceleratorVersion.$': '$.configuration.acceleratorVersion',
'baseline.$': '$.configuration.baseline',
'phases.$': '$.configuration.phases',
'storeAllOutputs.$': '$.configuration.storeAllOutputs',
'regions.$': '$.configuration.regions',
'accounts.$': '$.configuration.accounts',
'configRootFilePath.$': '$.configuration.configRootFilePath',
Expand Down Expand Up @@ -590,6 +597,43 @@ export namespace InitialSetup {
return storeOutputsTask;
};

const storeAllPhaseOutputs = new sfn.Map(this, `Store All Phase Outputs Map`, {
itemsPath: '$.phases',
resultPath: 'DISCARD',
maxConcurrency: 1,
parameters: {
'accounts.$': '$.accounts',
'regions.$': '$.regions',
acceleratorPrefix: props.acceleratorPrefix,
assumeRoleName: props.stateMachineExecutionRole,
outputsTable: outputsTable.tableName,
configRepositoryName: props.configRepositoryName,
'phaseNumber.$': '$$.Map.Item.Value',
'configFilePath.$': '$.configFilePath',
'configCommitId.$': '$.configCommitId',
},
});

const storeAllOutputsTask = new sfn.Task(this, `Store All Phase Outputs`, {
// tslint:disable-next-line: deprecation
task: new tasks.StartExecution(storeOutputsStateMachine, {
integrationPattern: sfn.ServiceIntegrationPattern.SYNC,
input: {
'accounts.$': '$.accounts',
'regions.$': '$.regions',
acceleratorPrefix: props.acceleratorPrefix,
assumeRoleName: props.stateMachineExecutionRole,
outputsTable: outputsTable.tableName,
configRepositoryName: props.configRepositoryName,
'phaseNumber.$': '$.phaseNumber',
'configFilePath.$': '$.configFilePath',
'configCommitId.$': '$.configCommitId',
},
}),
resultPath: 'DISCARD',
});
storeAllPhaseOutputs.iterator(storeAllOutputsTask);

// TODO Create separate state machine for deployment
const deployPhaseRolesTask = createDeploymentTask(-1, false);
const storePreviousOutput = createStoreOutputTask(-1);
Expand Down Expand Up @@ -675,23 +719,6 @@ export namespace InitialSetup {
resultPath: 'DISCARD',
});

const associateHostedZonesTask = new CodeTask(this, 'Associate Hosted Zones', {
functionProps: {
code: lambdaCode,
handler: 'index.associateHostedZonesStep',
role: pipelineRole,
},
functionPayload: {
parametersTableName: parametersTable.tableName,
assumeRoleName: props.stateMachineExecutionRole,
'configRepositoryName.$': '$.configRepositoryName',
'configFilePath.$': '$.configFilePath',
'configCommitId.$': '$.configCommitId',
outputTableName: outputsTable.tableName,
},
resultPath: 'DISCARD',
});

const addTagsToSharedResourcesTask = new CodeTask(this, 'Add Tags to Shared Resources', {
functionProps: {
code: lambdaCode,
Expand Down Expand Up @@ -775,7 +802,6 @@ export namespace InitialSetup {
.next(storePhase3Output)
.next(deployPhase4Task)
.next(storePhase4Output)
.next(associateHostedZonesTask)
.next(addTagsToSharedResourcesTask)
.next(enableDirectorySharingTask)
.next(deployPhase5Task)
Expand All @@ -788,18 +814,25 @@ export namespace InitialSetup {
.otherwise(commonStep1)
.afterwards();

const commonStep2 = deployPhaseRolesTask
.next(storePreviousOutput)
.next(deployPhase0Task)
.next(storePhase0Output)
.next(verifyFilesTask)
.next(enableConfigChoice);

const storeAllOutputsChoice = new sfn.Choice(this, 'Store All Phase Outputs?')
.when(sfn.Condition.booleanEquals('$.storeAllOutputs', true), storeAllPhaseOutputs.next(commonStep2))
.otherwise(commonStep2)
.afterwards();

const commonDefinition = loadOrganizationsTask.startState
.next(loadAccountsTask)
.next(installRolesTask)
.next(deleteVpcTask)
.next(loadLimitsTask)
.next(enableTrustedAccessForServicesTask)
.next(deployPhaseRolesTask)
.next(storePreviousOutput)
.next(deployPhase0Task)
.next(storePhase0Output)
.next(verifyFilesTask)
.next(enableConfigChoice);
.next(storeAllOutputsChoice);

// Landing Zone Config Setup
const alzConfigDefinition = loadLandingZoneConfigurationTask.startState
Expand All @@ -823,8 +856,14 @@ export namespace InitialSetup {
.next(cloudFormationMasterRoleChoice);

const baseLineChoice = new sfn.Choice(this, 'Baseline?')
.when(sfn.Condition.stringEquals('$.configuration.baseline', 'LANDING_ZONE'), alzConfigDefinition)
.when(sfn.Condition.stringEquals('$.configuration.baseline', 'ORGANIZATIONS'), orgConfigDefinition)
.when(
sfn.Condition.stringEquals('$.configuration.baselineOutput.baseline', 'LANDING_ZONE'),
alzConfigDefinition,
)
.when(
sfn.Condition.stringEquals('$.configuration.baselineOutput.baseline', 'ORGANIZATIONS'),
orgConfigDefinition,
)
.otherwise(
new sfn.Fail(this, 'Fail', {
cause: 'Invalid Baseline supplied',
Expand Down
Loading