Skip to content

Commit 52d4f02

Browse files
chrisbbreuerchrisbbreuer
committed
chore: wip
1 parent 622daaa commit 52d4f02

File tree

7 files changed

+135
-148
lines changed

7 files changed

+135
-148
lines changed

‎.stacks/core/buddy/src/commands/cloud.ts

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
import process from 'node:process'
21
import { intro, italic, log, outro, prompts, runCommand, underline } from '@stacksjs/cli'
32
import { addJumpBox, deleteCdkRemnants, deleteJumpBox, deleteLogGroups, deleteStacksBuckets, deleteStacksFunctions, getJumpBoxInstanceId } from '@stacksjs/cloud'
43
import { path as p } from '@stacksjs/path'
54
import type { CLI, CloudCliOptions } from '@stacksjs/types'
65
import { ExitCode } from '@stacksjs/types'
6+
import process from 'node:process'
77

88
export function cloud(buddy: CLI) {
99
const descriptions = {
@@ -152,7 +152,7 @@ export function cloud(buddy: CLI) {
152152
stdin: 'inherit',
153153
})
154154

155-
await outro('Your cloud has now been removed', { startTime, useSeconds: true })
155+
await outro('Your cloud has been removed', { startTime, useSeconds: true })
156156
process.exit(ExitCode.Success)
157157
})
158158

@@ -220,12 +220,14 @@ export function cloud(buddy: CLI) {
220220
const result3 = await deleteStacksFunctions()
221221

222222
if (result3.isErr()) {
223-
if (result3.error !== 'No stacks functions found') {
223+
if (result3.error !== 'No stacks functions found')
224224
await outro('While deleting the Origin Request Lambda function, there was an issue', { startTime, useSeconds: true }, result3.error)
225-
process.exit(ExitCode.FatalError)
226-
}
225+
226+
process.exit(ExitCode.FatalError)
227227
}
228228

229+
log.info(result3.value)
230+
229231
log.info('Removing any remaining Stacks logs...')
230232
const result4 = await deleteLogGroups()
231233
// TODO: investigate other regions for edge (cloudfront) logs

‎.stacks/core/cloud/src/cloud.ts

Lines changed: 113 additions & 140 deletions
Original file line numberDiff line numberDiff line change
@@ -416,77 +416,58 @@ export class StacksCloud extends Stack {
416416
}
417417

418418
if (config.security.firewall?.httpHeaders?.length) {
419-
priorities.push(1)
420-
rules.push({
421-
name: 'HttpHeaderRule',
422-
priority: priorities.length,
423-
statement: {
424-
byteMatchStatement: {
425-
fieldToMatch: {
426-
singleHeader: {
427-
name: config.security.firewall.httpHeaders,
419+
config.security.firewall.httpHeaders.forEach((header, index) => {
420+
priorities.push(1)
421+
rules.push({
422+
name: `HttpHeaderRule${index}`,
423+
priority: priorities.length,
424+
statement: {
425+
byteMatchStatement: {
426+
fieldToMatch: {
427+
singleHeader: {
428+
name: header,
429+
},
428430
},
431+
positionalConstraint: 'EXACTLY',
432+
searchString: 'true',
433+
textTransformations: [
434+
{
435+
priority: index,
436+
type: 'NONE',
437+
},
438+
],
429439
},
430-
positionalConstraint: 'EXACTLY',
431-
searchString: 'true',
432-
textTransformations: [
433-
{
434-
priority: 0,
435-
type: 'NONE',
436-
},
437-
],
438440
},
439-
},
440-
action: {
441-
block: {},
442-
},
443-
visibilityConfig: {
444-
sampledRequestsEnabled: true,
445-
cloudWatchMetricsEnabled: true,
446-
metricName: 'HttpHeaderRule',
447-
},
448-
})
449-
}
450-
451-
if (config.security.firewall?.queryString?.length) {
452-
priorities.push(1)
453-
rules.push({
454-
name: 'QueryStringRule',
455-
priority: priorities.length,
456-
statement: {
457-
byteMatchStatement: {
458-
fieldToMatch: {
459-
queryString: {},
460-
},
461-
positionalConstraint: 'EXACTLY',
462-
searchString: config.security.firewall.queryString.join(', '),
463-
textTransformations: [
464-
{
465-
priority: 0,
466-
type: 'NONE',
467-
},
468-
],
441+
action: {
442+
block: {},
469443
},
470-
},
471-
action: {
472-
block: {},
473-
},
474-
visibilityConfig: {
475-
sampledRequestsEnabled: true,
476-
cloudWatchMetricsEnabled: true,
477-
metricName: 'QueryStringRule',
478-
},
444+
visibilityConfig: {
445+
sampledRequestsEnabled: true,
446+
cloudWatchMetricsEnabled: true,
447+
metricName: `HttpHeaderRule${index}`,
448+
},
449+
})
479450
})
480451
}
481452

482-
// if (config.security.firewall?.ipSets?.length) {
453+
// if (config.security.firewall?.queryString?.length) {
483454
// priorities.push(1)
484455
// rules.push({
485-
// name: 'IpSetRule',
456+
// name: 'QueryStringRule',
486457
// priority: priorities.length,
487458
// statement: {
488-
// ipSetReferenceStatement: {
489-
// arn: config.security.firewall.ipSets,
459+
// byteMatchStatement: {
460+
// fieldToMatch: {
461+
// queryString: {},
462+
// },
463+
// positionalConstraint: 'EXACTLY',
464+
// searchString: config.security.firewall.queryString.join(', '),
465+
// textTransformations: [
466+
// {
467+
// priority: 0,
468+
// type: 'NONE',
469+
// },
470+
// ],
490471
// },
491472
// },
492473
// action: {
@@ -495,86 +476,76 @@ export class StacksCloud extends Stack {
495476
// visibilityConfig: {
496477
// sampledRequestsEnabled: true,
497478
// cloudWatchMetricsEnabled: true,
498-
// metricName: 'IpSetRule',
479+
// metricName: 'QueryStringRule',
499480
// },
500481
// })
501482
// }
502483

503-
if (config.security.firewall?.rateLimitPerMinute) {
504-
priorities.push(1)
505-
rules.push({
506-
name: 'RateLimitRule',
507-
priority: priorities.length,
508-
statement: {
509-
rateBasedStatement: {
510-
limit: config.security.firewall.rateLimitPerMinute,
511-
aggregateKeyType: 'IP',
512-
scopeDownStatement: {
513-
notStatement: {
514-
statement: {
515-
rateBasedStatement: {
516-
limit: config.security.firewall.rateLimitPerMinute,
517-
aggregateKeyType: 'IP',
518-
},
519-
},
520-
},
521-
},
522-
},
523-
},
524-
action: {
525-
block: {},
526-
},
527-
visibilityConfig: {
528-
sampledRequestsEnabled: true,
529-
cloudWatchMetricsEnabled: true,
530-
metricName: 'RateLimitRule',
531-
},
532-
})
533-
}
484+
// if (config.security.firewall?.rateLimitPerMinute) {
485+
// priorities.push(1)
486+
// rules.push({
487+
// name: 'RateLimitRule',
488+
// priority: priorities.length,
489+
// statement: {
490+
// rateBasedStatement: {
491+
// limit: config.security.firewall.rateLimitPerMinute,
492+
// aggregateKeyType: 'IP',
493+
// },
494+
// },
495+
// action: {
496+
// block: {},
497+
// },
498+
// visibilityConfig: {
499+
// sampledRequestsEnabled: true,
500+
// cloudWatchMetricsEnabled: true,
501+
// metricName: 'RateLimitRule',
502+
// },
503+
// })
504+
// }
534505

535-
if (config.security.firewall?.useIpReputationLists) {
536-
priorities.push(1)
537-
rules.push({
538-
name: 'IpReputationRule',
539-
priority: priorities.length,
540-
statement: {
541-
managedRuleGroupStatement: {
542-
vendorName: 'AWS',
543-
name: 'AWSManagedRulesAmazonIpReputationList',
544-
},
545-
},
546-
action: {
547-
block: {},
548-
},
549-
visibilityConfig: {
550-
sampledRequestsEnabled: true,
551-
cloudWatchMetricsEnabled: true,
552-
metricName: 'IpReputationRule',
553-
},
554-
})
555-
}
506+
// if (config.security.firewall?.useIpReputationLists) {
507+
// priorities.push(1)
508+
// rules.push({
509+
// name: 'IpReputationRule',
510+
// priority: priorities.length,
511+
// statement: {
512+
// managedRuleGroupStatement: {
513+
// vendorName: 'AWS',
514+
// name: 'AWSManagedRulesAmazonIpReputationList',
515+
// },
516+
// },
517+
// action: {
518+
// block: {},
519+
// },
520+
// visibilityConfig: {
521+
// sampledRequestsEnabled: true,
522+
// cloudWatchMetricsEnabled: true,
523+
// metricName: 'IpReputationRule',
524+
// },
525+
// })
526+
// }
556527

557-
if (config.security.firewall?.useKnownBadInputsRuleSet) {
558-
priorities.push(1)
559-
rules.push({
560-
name: 'KnownBadInputsRule',
561-
priority: priorities.length,
562-
statement: {
563-
managedRuleGroupStatement: {
564-
vendorName: 'AWS',
565-
name: 'AWSManagedRulesKnownBadInputsRuleSet',
566-
},
567-
},
568-
action: {
569-
block: {},
570-
},
571-
visibilityConfig: {
572-
sampledRequestsEnabled: true,
573-
cloudWatchMetricsEnabled: true,
574-
metricName: 'KnownBadInputsRule',
575-
},
576-
})
577-
}
528+
// if (config.security.firewall?.useKnownBadInputsRuleSet) {
529+
// priorities.push(1)
530+
// rules.push({
531+
// name: 'KnownBadInputsRule',
532+
// priority: priorities.length,
533+
// statement: {
534+
// managedRuleGroupStatement: {
535+
// vendorName: 'AWS',
536+
// name: 'AWSManagedRulesKnownBadInputsRuleSet',
537+
// },
538+
// },
539+
// action: {
540+
// block: {},
541+
// },
542+
// visibilityConfig: {
543+
// sampledRequestsEnabled: true,
544+
// cloudWatchMetricsEnabled: true,
545+
// metricName: 'KnownBadInputsRule',
546+
// },
547+
// })
548+
// }
578549

579550
return rules
580551
}
@@ -749,21 +720,23 @@ export class StacksCloud extends Stack {
749720

750721
const sesPrincipal = new iam.ServicePrincipal('ses.amazonaws.com')
751722

752-
this.storage.emailBucket.addToResourcePolicy(new iam.PolicyStatement({
723+
const sesPolicy = new iam.PolicyStatement({
753724
sid: 'AllowSESPuts',
754725
effect: iam.Effect.ALLOW,
755726
principals: [sesPrincipal],
756727
actions: ['s3:PutObject'],
757728
resources: [
758-
// this.storage.emailBucket.arnForObjects('tmp/email_in/*'),
759-
this.storage.emailBucket.arnForObjects('*'),
729+
`${this.storage.emailBucket.bucketArn}`,
730+
`${this.storage.emailBucket.bucketArn}/*`,
760731
],
761732
conditions: {
762733
StringEquals: {
763734
'aws:Referer': this.account,
764735
},
765736
},
766-
}))
737+
})
738+
739+
this.storage.emailBucket.addToResourcePolicy(sesPolicy)
767740

768741
const iamGroup = new iam.Group(this, 'IAMGroup', {
769742
groupName: `${this.appName}-${appEnv}-email-management-s3-group`,
@@ -788,8 +761,8 @@ export class StacksCloud extends Stack {
788761
's3:PutObjectVersionAcl',
789762
],
790763
resources: [
791-
`arn:aws:s3:::${this.storage.emailBucket.bucketName}`,
792-
`arn:aws:s3:::${this.storage.emailBucket.bucketName}/*`,
764+
`${this.storage.emailBucket.bucketArn}`,
765+
`${this.storage.emailBucket.bucketArn}/*`,
793766
],
794767
})
795768

‎.stacks/core/cloud/src/helpers.ts

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -266,11 +266,18 @@ export async function deleteStacksFunctions() {
266266
const stacksFunctions = data.Functions?.filter(func => func.FunctionName?.includes('stacks')) || []
267267

268268
if (!stacksFunctions || stacksFunctions.length === 0)
269-
return err('No stacks functions found')
269+
return ok('No stacks functions found')
270270

271271
const promises = stacksFunctions.map(func => lambda.deleteFunction({ FunctionName: func.FunctionName || '' }))
272272

273-
await Promise.all(promises)
273+
await Promise.all(promises).catch((error: Error) => {
274+
if (error.message.includes('it is a replicated function')) {
275+
log.info('Function is replicated, skipping...')
276+
return ok('CloudFront is still deleting the some functions. Try again later.')
277+
}
278+
279+
return err(handleError('Error deleting stacks functions', error))
280+
})
274281

275282
return ok('Stacks functions deleted')
276283
}

‎.stacks/docs/.vitepress/custom.css renamed to ‎.stacks/docs/.vitepress/theme/custom.css

File renamed without changes.

‎.stacks/docs/.vitepress/theme/index.ts

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
// .vitepress/theme/index.js
2+
import DefaultTheme from 'vitepress/theme'
3+
import './custom.css'
4+
5+
export default DefaultTheme

‎bun.lockb

4.91 KB
Binary file not shown.

‎pkgx.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
dependencies:
2-
aws.amazon.com/cdk: ^2.101.1
2+
aws.amazon.com/cdk: ^2.102.0
33
aws.amazon.com/cli: ^2.13.7
44
bun.sh: ^1.0.6
55
caddyserver.com: ^2.7.4

0 commit comments

Comments
 (0)