Package: cdklabs.cdk-enterprise-iac
CDK Enterprise IaCUtilities for using CDK within enterprise constraints.InstallTypescriptnpminstall@cdklabs/cdk-enterprise-iacPythonpipinstallcdklabs.cdk-enterprise-iacWho this project is forWithin large enterprises, builders can come up against enterprise imposed constraints when deploying on AWS.This could be simple things such as "All IAM roles must have a specific Permissions Boundary attached".This could also be more restrictive such as strict separation of duties, only allowing certain teams the ability to deploy specific AWS resources (e.g. Networking team can deploy VPCs, Subnets, and route tables. Security team can deploy IAM resources. Developers can deploy Compute. DBAs can deploy Databases, etc.)Enterprises with very restrictive environments like these would benefit from taking a closer look at their policies to see how they can allow builders to safely deploy resources with less friction. However in many enterprises this is easier said than done, and builders are still expected to deliver.This project is meant to reduce friction for builders working within these enterprise constraints while the enterprise determines what policies make the most sense for their organization, and is in no way prescriptive.UsageThere are many tools available, all detailed inAPI.md.A few examples of these tools below:Adding permissions boundaries to all generated IAM rolesExample forAddPermissionBoundaryin Typescript project.# Example automatically generated from non-compiling source. May contain errors.importaws_cdkascdkfrom...lib.my_project_stackimportMyStackfromaws_cdkimportAspectsfromcdklabs.cdk_enterprise_iacimportAddPermissionBoundaryapp=cdk.App()MyStack(app,"MyStack")Aspects.of(app).add(AddPermissionBoundary(permissions_boundary_policy_name="MyPermissionBoundaryName",instance_profile_prefix="MY_PREFIX_",# optional, Defaults to ''policy_prefix="MY_POLICY_PREFIX_",# optional, Defaults to ''role_prefix="MY_ROLE_PREFIX_"))Example forAddPermissionBoundaryin Python project.importaws_cdkascdkfromcdklabs.cdk_enterprise_iacimportAddPermissionBoundaryfromtest_py.test_py_stackimportTestPyStackapp=cdk.App()TestPyStack(app,"TestPyStack")cdk.Aspects.of(app).add(AddPermissionBoundary(permissions_boundary_policy_name="MyPermissionBoundaryName",instance_profile_prefix="MY_PREFIX_",# optional, Defaults to ""policy_prefix="MY_POLICY_PREFIX_",# optional, Defaults to ""role_prefix="MY_ROLE_PREFIX_"# optional, Defaults to ""))app.synth()Resource extraction:warning: Resource extraction is in an experimental phase. Test and validate before using in production. Please open any issues foundhere.In many enterprises, there are separate teams with different IAM permissions than developers deploying CDK applications.For example there might be a networking team with permissions to deployAWS::EC2::SecurityGroupandAWS::EC2::EIP, or a security team with permissions to deployAWS::IAM::RoleandAWS::IAM::Policy, but the developers deploying the CDK don't have those permissions.When a developer doesn't have permissions to deploy necessary resources in their CDK application, writing good code becomes difficult to manage when a cdk deploy will quickly error due to not being able to deploy something like anAWS::IAM::Rolewhich is foundational to any project deployed into AWS.An enterprise shouldallowbuilders to deploy these resources via CDK formany reasons, and can usePermissions Boundariesto prevent privilege escalation. For enterprises that haven't yet utilized Permissions Boundaries, theResourceExtractorcan make it easier for builders to write good CDK while complying with enterprise policies.Using theResourceExtractorAspect, developers can write their CDK code as though they had sufficient IAM permissions, but extract those resources into a separate stack for an external team to deploy on their behalf.Take the following example stack:# Example automatically generated from non-compiling source. May contain errors.fromaws_cdkimportApp,Aspects,RemovalPolicy,Stackfromaws_cdk.aws_lambdaimportCode,Function,Runtimefromaws_cdk.aws_s3importBucketapp=App()app_stack=Stack(app,"MyAppStack")func=Function(app_stack,"TestLambda",code=Code.from_asset(path.join(__dirname,"lambda-handler")),handler="index.handler",runtime=Runtime.PYTHON_3_11)bucket=Bucket(app_stack,"TestBucket",auto_delete_objects=True,removal_policy=RemovalPolicy.DESTROY)bucket.grant_read_write(func)app.synth()The synthesized Cloudformation would includeallAWS resources required, including resources a developer might not have permissions to deployThe above example would include the following snippet in the synthesized CloudformationTestLambdaServiceRoleC28C2D9C:Type:'AWS::IAM::Role'Properties:AssumeRolePolicyDocument:Statement:-Action:'sts:AssumeRole'Effect:AllowPrincipal:Service:lambda.amazonaws.comVersion:2012-10-17# excluding remaining propertiesTestLambda2F70C45E:Type:'AWS::Lambda::Function'Properties:Role:!GetAtt-TestLambdaServiceRoleC28C2D9C-Arn# excluding remaining propertiesWhile includingbucket.grantReadWrite(func)in the CDK application ensures an IAM role with least privilege IAM policies for the application, the creation of IAM resources such as Roles and Policies may be restricted to a security team, resulting in the synthesized Cloudformation template not being deployable by a developer.Using theResourceExtractor, we can pull out an arbitrary list of Cloudformation resources that a developerdoesn'thave permissions to provision, and create a separate stack that can be sent to a security team.# Example automatically generated from non-compiling source. May contain errors.fromaws_cdkimportApp,Aspects,RemovalPolicy,Stackfromaws_cdk.aws_lambdaimportCode,Function,Runtimefromaws_cdk.aws_s3importBucket# Import ResourceExtractorfromcdklabs.cdk_enterprise_iacimportResourceExtractorapp=App()app_stack=Stack(app,"MyAppStack")# Set up a destination stack to extract resources toextracted_stack=Stack(app,"ExtractedStack")func=Function(app_stack,"TestLambda",code=Code.from_asset(path.join(__dirname,"lambda-handler")),handler="index.handler",runtime=Runtime.PYTHON_3_11)bucket=Bucket(app_stack,"TestBucket",auto_delete_objects=True,removal_policy=RemovalPolicy.DESTROY)bucket.grant_read_write(func)# Capture the output of app.synth()synthed_app=app.synth()# Apply the ResourceExtractor AspectAspects.of(app).add(ResourceExtractor(# synthesized stacks to examinestack_artifacts=synthed_app.stacks,# Array of Cloudformation resources to extractresource_types_to_extract=["AWS::IAM::Role","AWS::IAM::Policy","AWS::IAM::ManagedPolicy","AWS::IAM::InstanceProfile"],# Destination stack for extracted resourcesextract_destination_stack=extracted_stack))# Resynthing since ResourceExtractor has modified the appapp.synth(force=True)In the example above,allresources are created in theappStack, and an emptyextractedStackis also created.We apply theResourceExtractorAspect, specifying the Cloudformation resource types the developer is unable to deploy due to insufficient IAM permissions.Now when we list stacks in the CDK project, we can see an added stack$cdkls
MyAppStack
ExtractedStackTaking a look at these synthesized stacks, in theExtractedStackwe'll find:Resources:TestLambdaServiceRoleC28C2D9C:Type:'AWS::IAM::Role'Properties:AssumeRolePolicyDocument:Statement:-Action:'sts:AssumeRole'Effect:AllowPrincipal:Service:lambda.amazonaws.comVersion:2012-10-17# excluding remaining propertiesOutputs:ExportAppStackTestLambdaServiceRoleC28C2D9C:Value:'Fn::GetAtt':-TestLambdaServiceRoleC28C2D9C-ArnExport:Name:'AppStack:TestLambdaServiceRoleC28C2D9C'# Exported nameAnd inside the synthesizedMyAppStacktemplate:Resources:TestLambda2F70C45E:Type:'AWS::Lambda::Function'Properties:Role:!ImportValue'AppStack:TestLambdaServiceRoleC28C2D9C'# Using ImportValue instrinsic function to use pre-created IAM role# excluding remaining propertiesIn this scenario, a developer is able to provide an external security team with sufficient IAM privileges to deploy theExtractedStack.Once deployed, a developer can runcdk deploy MyAppStackwithout errors due to insufficient IAM privilegesValue Sharing methodsWhen resources are extracted from a stack, there must be a method to reference the resources that have been extracted.There are three methods (seeResourceExtractorShareMethodenum)CFN_OUTPUTSSM_PARAMETERAPI_LOOKUPCFN_OUTPUTThe default sharing method isCFN_OUTPUT, which uses Cloudformation Export/Import to Export values in the extracted stack (seeOutputs), and use theFn::ImportValueintrinsic function to reference those values.This works fine, but some teams may prefer a looser coupling between the extracted stack deployed by an external team and the rest of the CDK infrastructure.SSM_PARAMETERIn this method, the extracted stack generates Parameters in AWS Systems Manager Parameter Store, and modifies the CDK application to look up the generated parameter usingaws_ssm.StringParameter.valueFromLookup()at synthesis time.Example on using this method:# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportResourceExtractor,ResourceExtractorShareMethodAspects.of(app).add(ResourceExtractor(stack_artifacts=synthed_app.stacks,resource_types_to_extract=["AWS::IAM::Role","AWS::IAM::Policy","AWS::IAM::ManagedPolicy","AWS::IAM::InstanceProfile"],extract_destination_stack=extracted_stack,value_share_method=ResourceExtractorShareMethod.SSM_PARAMETER))API_LOOKUPTheAPI_LOOKUPsharing method is a work in progress, and not yet supportedResource PartialsSome resources that get extracted might reference resources that aren't yet created.In our example CDK application we include the line# Example automatically generated from non-compiling source. May contain errors.bucket.grant_read_write(func)This creates anAWS::IAM::Policythat includes the necessary Actions scoped down to the S3 bucket.When theAWS::IAM::Policyis extracted, it's unable to useReforFn::GetAttto reference the S3 bucket since the S3 bucket wasn't extracted.In this case we substitute the reference with a "partial ARN" that makes a best effort to scope the resources in the IAM policy statement to the ARN of the yet-to-be created S3 bucket.There are multiple resource types supported out of the box (found increateDefaultTransforms). In the event you have a resource not yet supported, you'll receive aMissingTransformError. In this case you can either open anissuewith the resource in question, or you can include theadditionalTransformsproperty.Consider the following:# Example automatically generated from non-compiling source. May contain errors.vpc=Vpc(stack,"TestVpc")db=DatabaseInstance(stack,"TestDb",vpc=vpc,engine=DatabaseInstanceEngine.POSTGRES)func=Function(stack,"TestLambda",{"code":Code.from_asset(path.join(__dirname,"lambda-handler")),"handler":"index.handler","runtime":Runtime.PYTHON_3_11})db.secret.grant_read(func)synthed_app=app.synth()Aspects.of(app).add(ResourceExtractor(extract_destination_stack=extracted_stack,stack_artifacts=synthed_app.stacks,value_share_method=ResourceExtractorShareMethod.CFN_OUTPUT,resource_types_to_extract=["AWS::IAM::Role","AWS::IAM::Policy"],additional_transforms={"AWS::SecretsManager::SecretTargetAttachment":f"arn:{Aws.PARTITION}:secretsmanager:{Aws.REGION}:{Aws.ACCOUNT_ID}:secret:some-expected-value*"}))app.synth(force=True)In this case, there is aAWS::SecretsManager::SecretTargetAttachmentgenerated to complete the final link between a Secrets Manager secret and the associated database by adding the database connection information to the secret JSON, which returns the ARN of the generated secret.In the context of extracting the IAM policy, we want to tell theResourceExtractorhow to handle the resource section of the IAM policy statement so that it is scoped down sufficiently.In this case rather than using aRef: LogicalIdForTheSecretTargetAttachmentwe construct the ARN we want to use.Details inAPI.mdGenerated API.mdGenerated API.md below:Expand to view API docsCDK Enterprise IaCUtilities for using CDK within enterprise constraints.InstallTypescriptnpminstall@cdklabs/cdk-enterprise-iacPythonpipinstallcdklabs.cdk-enterprise-iacWho this project is forWithin large enterprises, builders can come up against enterprise imposed constraints when deploying on AWS.This could be simple things such as "All IAM roles must have a specific Permissions Boundary attached".This could also be more restrictive such as strict separation of duties, only allowing certain teams the ability to deploy specific AWS resources (e.g. Networking team can deploy VPCs, Subnets, and route tables. Security team can deploy IAM resources. Developers can deploy Compute. DBAs can deploy Databases, etc.)Enterprises with very restrictive environments like these would benefit from taking a closer look at their policies to see how they can allow builders to safely deploy resources with less friction. However in many enterprises this is easier said than done, and builders are still expected to deliver.This project is meant to reduce friction for builders working within these enterprise constraints while the enterprise determines what policies make the most sense for their organization, and is in no way prescriptive.UsageThere are many tools available, all detailed inAPI.md.A few examples of these tools below:Adding permissions boundaries to all generated IAM rolesExample forAddPermissionBoundaryin Typescript project.# Example automatically generated from non-compiling source. May contain errors.importaws_cdkascdkfrom...lib.my_project_stackimportMyStackfromaws_cdkimportAspectsfromcdklabs.cdk_enterprise_iacimportAddPermissionBoundaryapp=cdk.App()MyStack(app,"MyStack")Aspects.of(app).add(AddPermissionBoundary(permissions_boundary_policy_name="MyPermissionBoundaryName",instance_profile_prefix="MY_PREFIX_",# optional, Defaults to ''policy_prefix="MY_POLICY_PREFIX_",# optional, Defaults to ''role_prefix="MY_ROLE_PREFIX_"))Example forAddPermissionBoundaryin Python project.importaws_cdkascdkfromcdklabs.cdk_enterprise_iacimportAddPermissionBoundaryfromtest_py.test_py_stackimportTestPyStackapp=cdk.App()TestPyStack(app,"TestPyStack")cdk.Aspects.of(app).add(AddPermissionBoundary(permissions_boundary_policy_name="MyPermissionBoundaryName",instance_profile_prefix="MY_PREFIX_",# optional, Defaults to ""policy_prefix="MY_POLICY_PREFIX_",# optional, Defaults to ""role_prefix="MY_ROLE_PREFIX_"# optional, Defaults to ""))app.synth()Resource extraction:warning: Resource extraction is in an experimental phase. Test and validate before using in production. Please open any issues foundhere.In many enterprises, there are separate teams with different IAM permissions than developers deploying CDK applications.For example there might be a networking team with permissions to deployAWS::EC2::SecurityGroupandAWS::EC2::EIP, or a security team with permissions to deployAWS::IAM::RoleandAWS::IAM::Policy, but the developers deploying the CDK don't have those permissions.When a developer doesn't have permissions to deploy necessary resources in their CDK application, writing good code becomes difficult to manage when a cdk deploy will quickly error due to not being able to deploy something like anAWS::IAM::Rolewhich is foundational to any project deployed into AWS.An enterprise shouldallowbuilders to deploy these resources via CDK formany reasons, and can usePermissions Boundariesto prevent privilege escalation. For enterprises that haven't yet utilized Permissions Boundaries, theResourceExtractorcan make it easier for builders to write good CDK while complying with enterprise policies.Using theResourceExtractorAspect, developers can write their CDK code as though they had sufficient IAM permissions, but extract those resources into a separate stack for an external team to deploy on their behalf.Take the following example stack:# Example automatically generated from non-compiling source. May contain errors.fromaws_cdkimportApp,Aspects,RemovalPolicy,Stackfromaws_cdk.aws_lambdaimportCode,Function,Runtimefromaws_cdk.aws_s3importBucketapp=App()app_stack=Stack(app,"MyAppStack")func=Function(app_stack,"TestLambda",code=Code.from_asset(path.join(__dirname,"lambda-handler")),handler="index.handler",runtime=Runtime.PYTHON_3_11)bucket=Bucket(app_stack,"TestBucket",auto_delete_objects=True,removal_policy=RemovalPolicy.DESTROY)bucket.grant_read_write(func)app.synth()The synthesized Cloudformation would includeallAWS resources required, including resources a developer might not have permissions to deployThe above example would include the following snippet in the synthesized CloudformationTestLambdaServiceRoleC28C2D9C:Type:'AWS::IAM::Role'Properties:AssumeRolePolicyDocument:Statement:-Action:'sts:AssumeRole'Effect:AllowPrincipal:Service:lambda.amazonaws.comVersion:2012-10-17# excluding remaining propertiesTestLambda2F70C45E:Type:'AWS::Lambda::Function'Properties:Role:!GetAtt-TestLambdaServiceRoleC28C2D9C-Arn# excluding remaining propertiesWhile includingbucket.grantReadWrite(func)in the CDK application ensures an IAM role with least privilege IAM policies for the application, the creation of IAM resources such as Roles and Policies may be restricted to a security team, resulting in the synthesized Cloudformation template not being deployable by a developer.Using theResourceExtractor, we can pull out an arbitrary list of Cloudformation resources that a developerdoesn'thave permissions to provision, and create a separate stack that can be sent to a security team.# Example automatically generated from non-compiling source. May contain errors.fromaws_cdkimportApp,Aspects,RemovalPolicy,Stackfromaws_cdk.aws_lambdaimportCode,Function,Runtimefromaws_cdk.aws_s3importBucket# Import ResourceExtractorfromcdklabs.cdk_enterprise_iacimportResourceExtractorapp=App()app_stack=Stack(app,"MyAppStack")# Set up a destination stack to extract resources toextracted_stack=Stack(app,"ExtractedStack")func=Function(app_stack,"TestLambda",code=Code.from_asset(path.join(__dirname,"lambda-handler")),handler="index.handler",runtime=Runtime.PYTHON_3_11)bucket=Bucket(app_stack,"TestBucket",auto_delete_objects=True,removal_policy=RemovalPolicy.DESTROY)bucket.grant_read_write(func)# Capture the output of app.synth()synthed_app=app.synth()# Apply the ResourceExtractor AspectAspects.of(app).add(ResourceExtractor(# synthesized stacks to examinestack_artifacts=synthed_app.stacks,# Array of Cloudformation resources to extractresource_types_to_extract=["AWS::IAM::Role","AWS::IAM::Policy","AWS::IAM::ManagedPolicy","AWS::IAM::InstanceProfile"],# Destination stack for extracted resourcesextract_destination_stack=extracted_stack))# Resynthing since ResourceExtractor has modified the appapp.synth(force=True)In the example above,allresources are created in theappStack, and an emptyextractedStackis also created.We apply theResourceExtractorAspect, specifying the Cloudformation resource types the developer is unable to deploy due to insufficient IAM permissions.Now when we list stacks in the CDK project, we can see an added stack$cdkls
MyAppStack
ExtractedStackTaking a look at these synthesized stacks, in theExtractedStackwe'll find:Resources:TestLambdaServiceRoleC28C2D9C:Type:'AWS::IAM::Role'Properties:AssumeRolePolicyDocument:Statement:-Action:'sts:AssumeRole'Effect:AllowPrincipal:Service:lambda.amazonaws.comVersion:2012-10-17# excluding remaining propertiesOutputs:ExportAppStackTestLambdaServiceRoleC28C2D9C:Value:'Fn::GetAtt':-TestLambdaServiceRoleC28C2D9C-ArnExport:Name:'AppStack:TestLambdaServiceRoleC28C2D9C'# Exported nameAnd inside the synthesizedMyAppStacktemplate:Resources:TestLambda2F70C45E:Type:'AWS::Lambda::Function'Properties:Role:!ImportValue'AppStack:TestLambdaServiceRoleC28C2D9C'# Using ImportValue instrinsic function to use pre-created IAM role# excluding remaining propertiesIn this scenario, a developer is able to provide an external security team with sufficient IAM privileges to deploy theExtractedStack.Once deployed, a developer can runcdk deploy MyAppStackwithout errors due to insufficient IAM privilegesValue Sharing methodsWhen resources are extracted from a stack, there must be a method to reference the resources that have been extracted.There are three methods (seeResourceExtractorShareMethodenum)CFN_OUTPUTSSM_PARAMETERAPI_LOOKUPCFN_OUTPUTThe default sharing method isCFN_OUTPUT, which uses Cloudformation Export/Import to Export values in the extracted stack (seeOutputs), and use theFn::ImportValueintrinsic function to reference those values.This works fine, but some teams may prefer a looser coupling between the extracted stack deployed by an external team and the rest of the CDK infrastructure.SSM_PARAMETERIn this method, the extracted stack generates Parameters in AWS Systems Manager Parameter Store, and modifies the CDK application to look up the generated parameter usingaws_ssm.StringParameter.valueFromLookup()at synthesis time.Example on using this method:# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportResourceExtractor,ResourceExtractorShareMethodAspects.of(app).add(ResourceExtractor(stack_artifacts=synthed_app.stacks,resource_types_to_extract=["AWS::IAM::Role","AWS::IAM::Policy","AWS::IAM::ManagedPolicy","AWS::IAM::InstanceProfile"],extract_destination_stack=extracted_stack,value_share_method=ResourceExtractorShareMethod.SSM_PARAMETER))API_LOOKUPTheAPI_LOOKUPsharing method is a work in progress, and not yet supportedResource PartialsSome resources that get extracted might reference resources that aren't yet created.In our example CDK application we include the line# Example automatically generated from non-compiling source. May contain errors.bucket.grant_read_write(func)This creates anAWS::IAM::Policythat includes the necessary Actions scoped down to the S3 bucket.When theAWS::IAM::Policyis extracted, it's unable to useReforFn::GetAttto reference the S3 bucket since the S3 bucket wasn't extracted.In this case we substitute the reference with a "partial ARN" that makes a best effort to scope the resources in the IAM policy statement to the ARN of the yet-to-be created S3 bucket.There are multiple resource types supported out of the box (found increateDefaultTransforms). In the event you have a resource not yet supported, you'll receive aMissingTransformError. In this case you can either open anissuewith the resource in question, or you can include theadditionalTransformsproperty.Consider the following:# Example automatically generated from non-compiling source. May contain errors.vpc=Vpc(stack,"TestVpc")db=DatabaseInstance(stack,"TestDb",vpc=vpc,engine=DatabaseInstanceEngine.POSTGRES)func=Function(stack,"TestLambda",{"code":Code.from_asset(path.join(__dirname,"lambda-handler")),"handler":"index.handler","runtime":Runtime.PYTHON_3_11})db.secret.grant_read(func)synthed_app=app.synth()Aspects.of(app).add(ResourceExtractor(extract_destination_stack=extracted_stack,stack_artifacts=synthed_app.stacks,value_share_method=ResourceExtractorShareMethod.CFN_OUTPUT,resource_types_to_extract=["AWS::IAM::Role","AWS::IAM::Policy"],additional_transforms={"AWS::SecretsManager::SecretTargetAttachment":f"arn:{Aws.PARTITION}:secretsmanager:{Aws.REGION}:{Aws.ACCOUNT_ID}:secret:some-expected-value*"}))app.synth(force=True)In this case, there is aAWS::SecretsManager::SecretTargetAttachmentgenerated to complete the final link between a Secrets Manager secret and the associated database by adding the database connection information to the secret JSON, which returns the ARN of the generated secret.In the context of extracting the IAM policy, we want to tell theResourceExtractorhow to handle the resource section of the IAM policy statement so that it is scoped down sufficiently.In this case rather than using aRef: LogicalIdForTheSecretTargetAttachmentwe construct the ARN we want to use.Details inAPI.mdGenerated API.mdGenerated API.md below:Expand to view API docsAPI ReferenceConstructsEcsIsoServiceAutoscalerCreates a EcsIsoServiceAutoscaler construct.This construct allows you to scale an ECS service in an ISO
region where classic ECS Autoscaling may not be available.Initializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportEcsIsoServiceAutoscalerEcsIsoServiceAutoscaler(scope,Construct,id,string,props,EcsIsoServiceAutoscalerProps)NameTypeDescriptionscopeconstructs.ConstructNo description.idstringNo description.propsEcsIsoServiceAutoscalerPropsNo description.scopeRequiredType:constructs.ConstructidRequiredType:stringpropsRequiredType:EcsIsoServiceAutoscalerPropsMethodsNameDescriptiontoStringReturns a string representation of this construct.toString# Example automatically generated from non-compiling source. May contain errors.to_string()stringReturns a string representation of this construct.Static FunctionsNameDescriptionisConstructChecks ifxis a construct.isConstruct# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportEcsIsoServiceAutoscalerEcsIsoServiceAutoscaler.is_construct(x,any)Checks ifxis a construct.xRequiredType:anyAny object.PropertiesNameTypeDescriptionnodeconstructs.NodeThe tree node.ecsScalingManagerFunctionaws-cdk-lib.aws_lambda.FunctionNo description.nodeRequired# Example automatically generated from non-compiling source. May contain errors.node:Node;Type:constructs.NodeThe tree node.ecsScalingManagerFunctionRequiredecsScalingManagerFunction:Function;Type:aws-cdk-lib.aws_lambda.FunctionPopulateWithConfigPopulate a provided VPC with subnets based on a provided configuration.Example# Example automatically generated from non-compiling source. May contain errors.my_subnet_config=[{"group_name":"app","cidr_range":"172.31.0.0/27","availability_zone":"a","subnet_type":subnet_type.PUBLIC},{"group_name":"app","cidr_range":"172.31.0.32/27","availability_zone":"b","subnet_type":subnet_type.PUBLIC},{"group_name":"db","cidr_range":"172.31.0.64/27","availability_zone":"a","subnet_type":subnet_type.PRIVATE_WITH_EGRESS},{"group_name":"db","cidr_range":"172.31.0.96/27","availability_zone":"b","subnet_type":subnet_type.PRIVATE_WITH_EGRESS},{"group_name":"iso","cidr_range":"172.31.0.128/26","availability_zone":"a","subnet_type":subnet_type.PRIVATE_ISOLATED},{"group_name":"iso","cidr_range":"172.31.0.196/26","availability_zone":"b","subnet_type":subnet_type.PRIVATE_ISOLATED}]PopulateWithConfig(self,"vpcPopulater",vpc_id="vpc-abcdefg1234567",private_route_table_id="rt-abcdefg123456",local_route_table_id="rt-123456abcdefg",subnet_config=my_subnet_config)Initializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportPopulateWithConfigPopulateWithConfig(scope,Construct,id,string,props,PopulateWithConfigProps)NameTypeDescriptionscopeconstructs.ConstructNo description.idstringNo description.propsPopulateWithConfigPropsNo description.scopeRequiredType:constructs.ConstructidRequiredType:stringpropsRequiredType:PopulateWithConfigPropsMethodsNameDescriptiontoStringReturns a string representation of this construct.toString# Example automatically generated from non-compiling source. May contain errors.to_string()stringReturns a string representation of this construct.Static FunctionsNameDescriptionisConstructChecks ifxis a construct.isConstruct# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportPopulateWithConfigPopulateWithConfig.is_construct(x,any)Checks ifxis a construct.xRequiredType:anyAny object.PropertiesNameTypeDescriptionnodeconstructs.NodeThe tree node.nodeRequired# Example automatically generated from non-compiling source. May contain errors.node:Node;Type:constructs.NodeThe tree node.SplitVpcEvenlySplits a VPC evenly between a provided number of AZs (3 if not defined), and attaches a provided route table to each, and labels.Example# Example automatically generated from non-compiling source. May contain errors.# with more specific propertiesSplitVpcEvenly(self,"evenSplitVpc",vpc_id="vpc-abcdefg123456",vpc_cidr="172.16.0.0/16",route_table_id="rt-abcdefgh123456",cidr_bits="10",number_of_azs=4,subnet_type=subnet_type.PRIVATE_ISOLATED)Initializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportSplitVpcEvenlySplitVpcEvenly(scope,Construct,id,string,props,SplitVpcEvenlyProps)NameTypeDescriptionscopeconstructs.ConstructNo description.idstringNo description.propsSplitVpcEvenlyPropsNo description.scopeRequiredType:constructs.ConstructidRequiredType:stringpropsRequiredType:SplitVpcEvenlyPropsMethodsNameDescriptiontoStringReturns a string representation of this construct.toString# Example automatically generated from non-compiling source. May contain errors.to_string()stringReturns a string representation of this construct.Static FunctionsNameDescriptionisConstructChecks ifxis a construct.isConstruct# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportSplitVpcEvenlySplitVpcEvenly.is_construct(x,any)Checks ifxis a construct.xRequiredType:anyAny object.PropertiesNameTypeDescriptionnodeconstructs.NodeThe tree node.nodeRequired# Example automatically generated from non-compiling source. May contain errors.node:Node;Type:constructs.NodeThe tree node.StructsAddCfnInitProxyPropsProperties for the proxy server to use with cfn helper commands.Initializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportAddCfnInitProxyPropsadd_cfn_init_proxy_props=AddCfnInitProxyProps(...)PropertiesNameTypeDescriptionproxyHoststringhost of your proxy.proxyPortnumberproxy port.proxyCredentialsaws-cdk-lib.aws_secretsmanager.ISecretJSON secret containinguserandpasswordproperties to use if your proxy requires credentialshttp://user:password@host:portcould contain sensitive data, so using a Secret.proxyTypeProxyTypeProxy Type.proxyHostRequired# Example automatically generated from non-compiling source. May contain errors.proxyHost:string;Type:stringhost of your proxy.Example# Example automatically generated from non-compiling source. May contain errors.example.comproxyPortRequired# Example automatically generated from non-compiling source. May contain errors.proxyPort:number;Type:numberproxy port.Example8080proxyCredentialsOptional# Example automatically generated from non-compiling source. May contain errors.proxyCredentials:ISecret;Type:aws-cdk-lib.aws_secretsmanager.ISecretJSON secret containinguserandpasswordproperties to use if your proxy requires credentialshttp://user:password@host:portcould contain sensitive data, so using a Secret.Note that while theuserandpasswordwon't be visible in the cloudformation template
theywillbe in plain text inside yourUserDataExample# Example automatically generated from non-compiling source. May contain errors.secret=Secret(stack,"TestSecret",secret_object_value={"user":SecretValue,"password":SecretValue})proxyTypeOptional# Example automatically generated from non-compiling source. May contain errors.proxyType:ProxyType;Type:ProxyTypeDefault:ProxyType.HTTPProxy Type.Example# Example automatically generated from non-compiling source. May contain errors.ProxyType.HTTPSAddPermissionBoundaryPropsProperties to pass to the AddPermissionBoundary.Initializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportAddPermissionBoundaryPropsadd_permission_boundary_props=AddPermissionBoundaryProps(...)PropertiesNameTypeDescriptionpermissionsBoundaryPolicyNamestringName of Permissions Boundary Policy to add to all IAM roles.instanceProfilePrefixstringA prefix to prepend to the name of the IAM InstanceProfiles (Default: '').policyPrefixstringA prefix to prepend to the name of the IAM Policies and ManagedPolicies (Default: '').rolePrefixstringA prefix to prepend to the name of IAM Roles (Default: '').permissionsBoundaryPolicyNameRequired# Example automatically generated from non-compiling source. May contain errors.permissionsBoundaryPolicyName:string;Type:stringName of Permissions Boundary Policy to add to all IAM roles.instanceProfilePrefixOptional# Example automatically generated from non-compiling source. May contain errors.instanceProfilePrefix:string;Type:stringA prefix to prepend to the name of the IAM InstanceProfiles (Default: '').policyPrefixOptional# Example automatically generated from non-compiling source. May contain errors.policyPrefix:string;Type:stringA prefix to prepend to the name of the IAM Policies and ManagedPolicies (Default: '').rolePrefixOptional# Example automatically generated from non-compiling source. May contain errors.rolePrefix:string;Type:stringA prefix to prepend to the name of IAM Roles (Default: '').EcsIsoServiceAutoscalerPropsInitializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportEcsIsoServiceAutoscalerPropsecs_iso_service_autoscaler_props=EcsIsoServiceAutoscalerProps(...)PropertiesNameTypeDescriptionecsClusteraws-cdk-lib.aws_ecs.ClusterThe cluster the service you wish to scale resides in.ecsServiceaws-cdk-lib.aws_ecs.IServiceThe ECS service you wish to scale.scaleAlarmaws-cdk-lib.aws_cloudwatch.AlarmBaseThe Cloudwatch Alarm that will cause scaling actions to be invoked, whether it's in or not in alarm will determine scale up and down actions.maximumTaskCountnumberThe maximum number of tasks that the service will scale out to.minimumTaskCountnumberThe minimum number of tasks the service will have.roleaws-cdk-lib.aws_iam.IRoleOptional IAM role to attach to the created lambda to adjust the desired count on the ECS Service.scaleInCooldownaws-cdk-lib.DurationHow long will the application wait before performing another scale in action.scaleInIncrementnumberThe number of tasks that will scale in on scale in alarm status.scaleOutCooldownaws-cdk-lib.DurationHow long will a the application wait before performing another scale out action.scaleOutIncrementnumberThe number of tasks that will scale out on scale out alarm status.ecsClusterRequired# Example automatically generated from non-compiling source. May contain errors.ecsCluster:Cluster;Type:aws-cdk-lib.aws_ecs.ClusterThe cluster the service you wish to scale resides in.ecsServiceRequired# Example automatically generated from non-compiling source. May contain errors.ecsService:IService;Type:aws-cdk-lib.aws_ecs.IServiceThe ECS service you wish to scale.scaleAlarmRequired# Example automatically generated from non-compiling source. May contain errors.scaleAlarm:AlarmBase;Type:aws-cdk-lib.aws_cloudwatch.AlarmBaseThe Cloudwatch Alarm that will cause scaling actions to be invoked, whether it's in or not in alarm will determine scale up and down actions.Note: composite alarms can not be generated with CFN in all regions, while this allows you to pass in a composite alarm alarm creation is outside the scope of this constructmaximumTaskCountOptional# Example automatically generated from non-compiling source. May contain errors.maximumTaskCount:number;Type:numberDefault:10The maximum number of tasks that the service will scale out to.Note: This does not provide any protection from scaling out above the maximum allowed in your account, set this variable and manage account quotas appropriately.minimumTaskCountOptional# Example automatically generated from non-compiling source. May contain errors.minimumTaskCount:number;Type:numberDefault:1The minimum number of tasks the service will have.roleOptional# Example automatically generated from non-compiling source. May contain errors.role:IRole;Type:aws-cdk-lib.aws_iam.IRoleDefault:A role is created for you with least privilege IAM policyOptional IAM role to attach to the created lambda to adjust the desired count on the ECS Service.Ensure this role has appropriate privileges. Example IAM policy statements:{"PolicyDocument":{"Statement":[{"Action":"cloudwatch:DescribeAlarms","Effect":"Allow","Resource":"*"},{"Action":["ecs:DescribeServices","ecs:UpdateService"],"Condition":{"StringEquals":{"ecs:cluster":"arn:${Partition}:ecs:${Region}:${Account}:cluster/${ClusterName}"}},"Effect":"Allow","Resource":"arn:${Partition}:ecs:${Region}:${Account}:service/${ClusterName}/${ServiceName}"}],"Version":"2012-10-17"}}scaleInCooldownOptional# Example automatically generated from non-compiling source. May contain errors.scaleInCooldown:Duration;Type:aws-cdk-lib.DurationDefault:60 secondsHow long will the application wait before performing another scale in action.scaleInIncrementOptional# Example automatically generated from non-compiling source. May contain errors.scaleInIncrement:number;Type:numberDefault:1The number of tasks that will scale in on scale in alarm status.scaleOutCooldownOptional# Example automatically generated from non-compiling source. May contain errors.scaleOutCooldown:Duration;Type:aws-cdk-lib.DurationDefault:60 secondsHow long will a the application wait before performing another scale out action.scaleOutIncrementOptional# Example automatically generated from non-compiling source. May contain errors.scaleOutIncrement:number;Type:numberDefault:1The number of tasks that will scale out on scale out alarm status.PopulateWithConfigPropsInitializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportPopulateWithConfigPropspopulate_with_config_props=PopulateWithConfigProps(...)PropertiesNameTypeDescriptionlocalRouteTableIdstringLocal route table ID, with routes only to local VPC.privateRouteTableIdstringRoute table ID for a provided route table with routes to enterprise network.subnetConfigSubnetConfig[]List of Subnet configs to provision to provision.vpcIdstringID of the VPC provided that needs to be populated.localRouteTableIdRequired# Example automatically generated from non-compiling source. May contain errors.localRouteTableId:string;Type:stringLocal route table ID, with routes only to local VPC.privateRouteTableIdRequired# Example automatically generated from non-compiling source. May contain errors.privateRouteTableId:string;Type:stringRoute table ID for a provided route table with routes to enterprise network.Both subnetType.PUBLIC and subnetType.PRIVATE_WITH_EGRESS will use this propertysubnetConfigRequired# Example automatically generated from non-compiling source. May contain errors.subnetConfig:SubnetConfig[];Type:SubnetConfig[]List of Subnet configs to provision to provision.vpcIdRequired# Example automatically generated from non-compiling source. May contain errors.vpcId:string;Type:stringID of the VPC provided that needs to be populated.RemoveTagsPropsInitializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportRemoveTagsPropsremove_tags_props=RemoveTagsProps(...)PropertiesNameTypeDescriptioncloudformationResourcestringName of Cloudformation resource Type (e.g. 'AWS::Lambda::Function').tagPropertyNamestringName of the tag property to remove from the resource.cloudformationResourceRequired# Example automatically generated from non-compiling source. May contain errors.cloudformationResource:string;Type:stringName of Cloudformation resource Type (e.g. 'AWS::Lambda::Function').tagPropertyNameOptional# Example automatically generated from non-compiling source. May contain errors.tagPropertyName:string;Type:stringDefault:TagsName of the tag property to remove from the resource.ResourceExtractorPropsInitializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportResourceExtractorPropsresource_extractor_props=ResourceExtractorProps(...)PropertiesNameTypeDescriptionextractDestinationStackaws-cdk-lib.StackStack to move found extracted resources into.resourceTypesToExtractstring[]List of resource types to extract, ex:AWS::IAM::Role.stackArtifactsaws-cdk-lib.cx_api.CloudFormationStackArtifact[]Synthed stack artifacts from your CDK app.additionalTransforms{[ key: string ]: string}Additional resource transformations.valueShareMethodResourceExtractorShareMethodThe sharing method to use when passing exported resources from the "Extracted Stack" into the original stack(s).extractDestinationStackRequiredextractDestinationStack:Stack;Type:aws-cdk-lib.StackStack to move found extracted resources into.resourceTypesToExtractRequired# Example automatically generated from non-compiling source. May contain errors.resourceTypesToExtract:string[];Type:string[]List of resource types to extract, ex:AWS::IAM::Role.stackArtifactsRequired# Example automatically generated from non-compiling source. May contain errors.stackArtifacts:CloudFormationStackArtifact[];Type:aws-cdk-lib.cx_api.CloudFormationStackArtifact[]Synthed stack artifacts from your CDK app.additionalTransformsOptional# Example automatically generated from non-compiling source. May contain errors.additionalTransforms:{[key:string]:string}Type:{[ key: string ]: string}Additional resource transformations.valueShareMethodOptional# Example automatically generated from non-compiling source. May contain errors.valueShareMethod:ResourceExtractorShareMethod;Type:ResourceExtractorShareMethodThe sharing method to use when passing exported resources from the "Extracted Stack" into the original stack(s).SetApiGatewayEndpointConfigurationPropsInitializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportSetApiGatewayEndpointConfigurationPropsset_api_gateway_endpoint_configuration_props=SetApiGatewayEndpointConfigurationProps(...)PropertiesNameTypeDescriptionendpointTypeaws-cdk-lib.aws_apigateway.EndpointTypeAPI Gateway endpoint type to override to.endpointTypeOptional# Example automatically generated from non-compiling source. May contain errors.endpointType:EndpointType;Type:aws-cdk-lib.aws_apigateway.EndpointTypeDefault:EndpointType.REGIONALAPI Gateway endpoint type to override to.Defaults to EndpointType.REGIONALSplitVpcEvenlyPropsInitializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportSplitVpcEvenlyPropssplit_vpc_evenly_props=SplitVpcEvenlyProps(...)PropertiesNameTypeDescriptionrouteTableIdstringRoute Table ID that will be attached to each subnet created.vpcCidrstringCIDR range of the VPC you're populating.vpcIdstringID of the existing VPC you're trying to populate.cidrBitsstringcidrBitsargument for theFn::CidrCloudformation intrinsic function.numberOfAzsnumberNumber of AZs to evenly split into.subnetTypeaws-cdk-lib.aws_ec2.SubnetTypeNo description.routeTableIdRequired# Example automatically generated from non-compiling source. May contain errors.routeTableId:string;Type:stringRoute Table ID that will be attached to each subnet created.vpcCidrRequired# Example automatically generated from non-compiling source. May contain errors.vpcCidr:string;Type:stringCIDR range of the VPC you're populating.vpcIdRequired# Example automatically generated from non-compiling source. May contain errors.vpcId:string;Type:stringID of the existing VPC you're trying to populate.cidrBitsOptional# Example automatically generated from non-compiling source. May contain errors.cidrBits:string;Type:stringDefault:'6'cidrBitsargument for theFn::CidrCloudformation intrinsic function.numberOfAzsOptional# Example automatically generated from non-compiling source. May contain errors.numberOfAzs:number;Type:numberDefault:3Number of AZs to evenly split into.subnetTypeOptional# Example automatically generated from non-compiling source. May contain errors.subnetType:SubnetType;Type:aws-cdk-lib.aws_ec2.SubnetTypeDefault:subnetType.PRIVATESubnetConfigInitializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportSubnetConfigsubnet_config=SubnetConfig(...)PropertiesNameTypeDescriptionavailabilityZonestringWhich availability zone the subnet should be in.cidrRangestringCidr range of the subnet to create.groupNamestringLogical group name of a subnet.subnetTypeaws-cdk-lib.aws_ec2.SubnetTypeWhatSubnetTypeto use.availabilityZoneRequired# Example automatically generated from non-compiling source. May contain errors.availabilityZone:string;Type:stringWhich availability zone the subnet should be in.cidrRangeRequired# Example automatically generated from non-compiling source. May contain errors.cidrRange:string;Type:stringCidr range of the subnet to create.groupNameRequired# Example automatically generated from non-compiling source. May contain errors.groupName:string;Type:stringLogical group name of a subnet.Example# Example automatically generated from non-compiling source. May contain errors.dbsubnetTypeRequired# Example automatically generated from non-compiling source. May contain errors.subnetType:SubnetType;Type:aws-cdk-lib.aws_ec2.SubnetTypeWhatSubnetTypeto use.This will govern theaws-cdk:subnet-typetag on the subnetSubnetTypeaws-cdk:subnet-typetag valuePRIVATE_ISOLATED'Isolated'PRIVATE_WITH_EGRESS'Private'PUBLIC'Public'ClassesAddCfnInitProxyImplements:aws-cdk-lib.IAspectAdd proxy configuration to Cloudformation helper functions.Initializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportAddCfnInitProxyAddCfnInitProxy(props,AddCfnInitProxyProps)NameTypeDescriptionpropsAddCfnInitProxyPropsNo description.propsRequiredType:AddCfnInitProxyPropsMethodsNameDescriptionvisitAll aspects can visit an IConstruct.visit# Example automatically generated from non-compiling source. May contain errors.visit(node,IConstruct)All aspects can visit an IConstruct.nodeRequiredType:constructs.IConstructAddLambdaEnvironmentVariablesImplements:aws-cdk-lib.IAspectAdd one or more environment variables toalllambda functions within a scope.Initializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportAddLambdaEnvironmentVariablesAddLambdaEnvironmentVariables(props,{"key":string,"string":string})NameTypeDescriptionprops{[ key: string ]: string}: string} props - Key Value pair(s) for environment variables to add to all lambda functions.propsRequiredType:{[ key: string ]: string}: string} props - Key Value pair(s) for environment variables to add to all lambda functions.MethodsNameDescriptionvisitAll aspects can visit an IConstruct.visit# Example automatically generated from non-compiling source. May contain errors.visit(node,IConstruct)All aspects can visit an IConstruct.nodeRequiredType:constructs.IConstructAddPermissionBoundaryImplements:aws-cdk-lib.IAspectA patch for Adding Permissions Boundaries to all IAM roles.Additional options for adding prefixes to IAM role, policy and instance profile namesCan account for non commercial partitions (e.g. aws-gov, aws-cn)Initializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportAddPermissionBoundaryAddPermissionBoundary(props,AddPermissionBoundaryProps)NameTypeDescriptionpropsAddPermissionBoundaryPropsNo description.propsRequiredType:AddPermissionBoundaryPropsMethodsNameDescriptioncheckAndOverrideNo description.visitAll aspects can visit an IConstruct.checkAndOverride# Example automatically generated from non-compiling source. May contain errors.check_and_override(node,CfnResource,prefix,string,length,number,cfn_prop,string,cdkProp?:string)nodeRequiredType:aws-cdk-lib.CfnResourceprefixRequiredType:stringlengthRequiredType:numbercfnPropRequiredType:stringcdkPropOptionalType:stringvisit# Example automatically generated from non-compiling source. May contain errors.visit(node,IConstruct)All aspects can visit an IConstruct.nodeRequiredType:constructs.IConstructConvertInlinePoliciesToManagedImplements:aws-cdk-lib.IAspectPatch for turning all Policies into ConvertInlinePoliciesToManaged.Some users have policies in place that make it impossible to create inline policies. Instead,
they must use managed policies.Note that order matters with this aspect. Specifically, it should generally be added first.
This is because other aspects may add overrides that would be lost if applied before
this aspect since the original aspect is removed and replaced.Example# Example automatically generated from non-compiling source. May contain errors.# Replace all AWS::IAM::Policy resources with equivalent AWS::IAM::ManagedPolicyAspects.of(stack).add(ConvertInlinePoliciesToManaged())Initializersfromcdklabs.cdk_enterprise_iacimportConvertInlinePoliciesToManagedConvertInlinePoliciesToManaged()NameTypeDescriptionMethodsNameDescriptionvisitAll aspects can visit an IConstruct.visit# Example automatically generated from non-compiling source. May contain errors.visit(node,IConstruct)All aspects can visit an IConstruct.nodeRequiredType:constructs.IConstructRemovePublicAccessBlockConfigurationImplements:aws-cdk-lib.IAspectLooks for S3 Buckets, and removes thePublicAccessBlockConfigurationproperty.For use in regions where Cloudformation doesn't support this propertyInitializersfromcdklabs.cdk_enterprise_iacimportRemovePublicAccessBlockConfigurationRemovePublicAccessBlockConfiguration()NameTypeDescriptionMethodsNameDescriptionvisitAll aspects can visit an IConstruct.visit# Example automatically generated from non-compiling source. May contain errors.visit(node,IConstruct)All aspects can visit an IConstruct.nodeRequiredType:constructs.IConstructRemoveTagsImplements:aws-cdk-lib.IAspectPatch for removing tags from a specific Cloudformation Resource.In some regions, the 'Tags' property isn't supported in Cloudformation. This patch makes it easy to removeExample# Example automatically generated from non-compiling source. May contain errors.# Remove tags on a resourceAspects.of(stack).add(RemoveTags(cloudformation_resource="AWS::ECS::Cluster"))# Remove tags without the standard 'Tags' nameAspects.of(stack).add(RemoveTags(cloudformation_resource="AWS::Backup::BackupPlan",tag_property_name="BackupPlanTags"))Initializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportRemoveTagsRemoveTags(props,RemoveTagsProps)NameTypeDescriptionpropsRemoveTagsPropsNo description.propsRequiredType:RemoveTagsPropsMethodsNameDescriptionvisitAll aspects can visit an IConstruct.visit# Example automatically generated from non-compiling source. May contain errors.visit(node,IConstruct)All aspects can visit an IConstruct.nodeRequiredType:constructs.IConstructResourceExtractorImplements:aws-cdk-lib.IAspectThis Aspect takes a CDK application, all synthesized CloudFormationStackArtifact, a value share method, and a list of Cloudformation resources that should be pulled out of the main CDK application, which should be synthesized to a cloudformation template that an external team (e.g. security team) to deploy, and adjusting the CDK application to reference pre-created resources already pulled out.Example# Example automatically generated from non-compiling source. May contain errors.app=App()stack=Stack(app,"MyStack")extracted_stack=Stack(app,"ExtractedStack")synthed_app=app.synth()Aspects.of(app).add(ResourceExtractor(extract_destination_stack=extracted_stack,stack_artifacts=synthed_app.stacks,value_share_method=ResourceExtractorShareMethod.CFN_OUTPUT,resource_types_to_extract=["AWS::IAM::Role","AWS::IAM::Policy","AWS::IAM::ManagedPolicy","AWS::IAM::InstanceProfile"]))app.synth(force=True)Initializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportResourceExtractorResourceExtractor(props,ResourceExtractorProps)NameTypeDescriptionpropsResourceExtractorPropsNo description.propsRequiredType:ResourceExtractorPropsMethodsNameDescriptionvisitEntrypoint.visit# Example automatically generated from non-compiling source. May contain errors.visit(node,IConstruct)Entrypoint.nodeRequiredType:constructs.IConstructSetApiGatewayEndpointConfigurationImplements:aws-cdk-lib.IAspectOverride RestApis to use a set endpoint configuration.Some regions don't support EDGE endpoints, and some enterprises require
specific endpoint types for RestApisInitializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportSetApiGatewayEndpointConfigurationSetApiGatewayEndpointConfiguration(props?:SetApiGatewayEndpointConfigurationProps)NameTypeDescriptionpropsSetApiGatewayEndpointConfigurationPropsNo description.propsOptionalType:SetApiGatewayEndpointConfigurationPropsMethodsNameDescriptionvisitAll aspects can visit an IConstruct.visit# Example automatically generated from non-compiling source. May contain errors.visit(node,IConstruct)All aspects can visit an IConstruct.nodeRequiredType:constructs.IConstructEnumsProxyTypeWhether an http-proxy or https-proxy.MembersNameDescriptionHTTP--http-proxy.HTTPS--https-proxy.HTTP-http-proxy.HTTPS-https-proxy.ResourceExtractorShareMethodThe available value sharing methods to pass values from the extracted stack onto the original stack(s).MembersNameDescriptionCFN_OUTPUTNo description.SSM_PARAMETERNo description.API_LOOKUPNo description.CFN_OUTPUTSSM_PARAMETERAPI_LOOKUPResourceTransformMembersNameDescriptionSTACK_NAMENo description.LOGICAL_IDNo description.STACK_NAMELOGICAL_IDAPI ReferenceConstructsEcsIsoServiceAutoscalerCreates a EcsIsoServiceAutoscaler construct.This construct allows you to scale an ECS service in an ISO
region where classic ECS Autoscaling may not be available.Initializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportEcsIsoServiceAutoscalerEcsIsoServiceAutoscaler(scope,Construct,id,string,props,EcsIsoServiceAutoscalerProps)NameTypeDescriptionscopeconstructs.ConstructNo description.idstringNo description.propsEcsIsoServiceAutoscalerPropsNo description.scopeRequiredType:constructs.ConstructidRequiredType:stringpropsRequiredType:EcsIsoServiceAutoscalerPropsMethodsNameDescriptiontoStringReturns a string representation of this construct.toString# Example automatically generated from non-compiling source. May contain errors.to_string()stringReturns a string representation of this construct.Static FunctionsNameDescriptionisConstructChecks ifxis a construct.isConstruct# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportEcsIsoServiceAutoscalerEcsIsoServiceAutoscaler.is_construct(x,any)Checks ifxis a construct.xRequiredType:anyAny object.PropertiesNameTypeDescriptionnodeconstructs.NodeThe tree node.ecsScalingManagerFunctionaws-cdk-lib.aws_lambda.FunctionNo description.nodeRequired# Example automatically generated from non-compiling source. May contain errors.node:Node;Type:constructs.NodeThe tree node.ecsScalingManagerFunctionRequiredecsScalingManagerFunction:Function;Type:aws-cdk-lib.aws_lambda.FunctionPopulateWithConfigPopulate a provided VPC with subnets based on a provided configuration.Example# Example automatically generated from non-compiling source. May contain errors.my_subnet_config=[{"group_name":"app","cidr_range":"172.31.0.0/27","availability_zone":"a","subnet_type":subnet_type.PUBLIC},{"group_name":"app","cidr_range":"172.31.0.32/27","availability_zone":"b","subnet_type":subnet_type.PUBLIC},{"group_name":"db","cidr_range":"172.31.0.64/27","availability_zone":"a","subnet_type":subnet_type.PRIVATE_WITH_EGRESS},{"group_name":"db","cidr_range":"172.31.0.96/27","availability_zone":"b","subnet_type":subnet_type.PRIVATE_WITH_EGRESS},{"group_name":"iso","cidr_range":"172.31.0.128/26","availability_zone":"a","subnet_type":subnet_type.PRIVATE_ISOLATED},{"group_name":"iso","cidr_range":"172.31.0.196/26","availability_zone":"b","subnet_type":subnet_type.PRIVATE_ISOLATED}]PopulateWithConfig(self,"vpcPopulater",vpc_id="vpc-abcdefg1234567",private_route_table_id="rt-abcdefg123456",local_route_table_id="rt-123456abcdefg",subnet_config=my_subnet_config)Initializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportPopulateWithConfigPopulateWithConfig(scope,Construct,id,string,props,PopulateWithConfigProps)NameTypeDescriptionscopeconstructs.ConstructNo description.idstringNo description.propsPopulateWithConfigPropsNo description.scopeRequiredType:constructs.ConstructidRequiredType:stringpropsRequiredType:PopulateWithConfigPropsMethodsNameDescriptiontoStringReturns a string representation of this construct.toString# Example automatically generated from non-compiling source. May contain errors.to_string()stringReturns a string representation of this construct.Static FunctionsNameDescriptionisConstructChecks ifxis a construct.isConstruct# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportPopulateWithConfigPopulateWithConfig.is_construct(x,any)Checks ifxis a construct.xRequiredType:anyAny object.PropertiesNameTypeDescriptionnodeconstructs.NodeThe tree node.nodeRequired# Example automatically generated from non-compiling source. May contain errors.node:Node;Type:constructs.NodeThe tree node.SplitVpcEvenlySplits a VPC evenly between a provided number of AZs (3 if not defined), and attaches a provided route table to each, and labels.Example# Example automatically generated from non-compiling source. May contain errors.# with more specific propertiesSplitVpcEvenly(self,"evenSplitVpc",vpc_id="vpc-abcdefg123456",vpc_cidr="172.16.0.0/16",route_table_id="rt-abcdefgh123456",cidr_bits="10",number_of_azs=4,subnet_type=subnet_type.PRIVATE_ISOLATED)Initializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportSplitVpcEvenlySplitVpcEvenly(scope,Construct,id,string,props,SplitVpcEvenlyProps)NameTypeDescriptionscopeconstructs.ConstructNo description.idstringNo description.propsSplitVpcEvenlyPropsNo description.scopeRequiredType:constructs.ConstructidRequiredType:stringpropsRequiredType:SplitVpcEvenlyPropsMethodsNameDescriptiontoStringReturns a string representation of this construct.toString# Example automatically generated from non-compiling source. May contain errors.to_string()stringReturns a string representation of this construct.Static FunctionsNameDescriptionisConstructChecks ifxis a construct.isConstruct# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportSplitVpcEvenlySplitVpcEvenly.is_construct(x,any)Checks ifxis a construct.xRequiredType:anyAny object.PropertiesNameTypeDescriptionnodeconstructs.NodeThe tree node.nodeRequired# Example automatically generated from non-compiling source. May contain errors.node:Node;Type:constructs.NodeThe tree node.StructsAddCfnInitProxyPropsProperties for the proxy server to use with cfn helper commands.Initializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportAddCfnInitProxyPropsadd_cfn_init_proxy_props=AddCfnInitProxyProps(...)PropertiesNameTypeDescriptionproxyHoststringhost of your proxy.proxyPortnumberproxy port.proxyCredentialsaws-cdk-lib.aws_secretsmanager.ISecretJSON secret containinguserandpasswordproperties to use if your proxy requires credentialshttp://user:password@host:portcould contain sensitive data, so using a Secret.proxyTypeProxyTypeProxy Type.proxyHostRequired# Example automatically generated from non-compiling source. May contain errors.proxyHost:string;Type:stringhost of your proxy.Example# Example automatically generated from non-compiling source. May contain errors.example.comproxyPortRequired# Example automatically generated from non-compiling source. May contain errors.proxyPort:number;Type:numberproxy port.Example8080proxyCredentialsOptional# Example automatically generated from non-compiling source. May contain errors.proxyCredentials:ISecret;Type:aws-cdk-lib.aws_secretsmanager.ISecretJSON secret containinguserandpasswordproperties to use if your proxy requires credentialshttp://user:password@host:portcould contain sensitive data, so using a Secret.Note that while theuserandpasswordwon't be visible in the cloudformation template
theywillbe in plain text inside yourUserDataExample# Example automatically generated from non-compiling source. May contain errors.secret=Secret(stack,"TestSecret",secret_object_value={"user":SecretValue,"password":SecretValue})proxyTypeOptional# Example automatically generated from non-compiling source. May contain errors.proxyType:ProxyType;Type:ProxyTypeDefault:ProxyType.HTTPProxy Type.Example# Example automatically generated from non-compiling source. May contain errors.ProxyType.HTTPSAddPermissionBoundaryPropsProperties to pass to the AddPermissionBoundary.Initializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportAddPermissionBoundaryPropsadd_permission_boundary_props=AddPermissionBoundaryProps(...)PropertiesNameTypeDescriptionpermissionsBoundaryPolicyNamestringName of Permissions Boundary Policy to add to all IAM roles.instanceProfilePrefixstringA prefix to prepend to the name of the IAM InstanceProfiles (Default: '').policyPrefixstringA prefix to prepend to the name of the IAM Policies and ManagedPolicies (Default: '').rolePrefixstringA prefix to prepend to the name of IAM Roles (Default: '').permissionsBoundaryPolicyNameRequired# Example automatically generated from non-compiling source. May contain errors.permissionsBoundaryPolicyName:string;Type:stringName of Permissions Boundary Policy to add to all IAM roles.instanceProfilePrefixOptional# Example automatically generated from non-compiling source. May contain errors.instanceProfilePrefix:string;Type:stringA prefix to prepend to the name of the IAM InstanceProfiles (Default: '').policyPrefixOptional# Example automatically generated from non-compiling source. May contain errors.policyPrefix:string;Type:stringA prefix to prepend to the name of the IAM Policies and ManagedPolicies (Default: '').rolePrefixOptional# Example automatically generated from non-compiling source. May contain errors.rolePrefix:string;Type:stringA prefix to prepend to the name of IAM Roles (Default: '').EcsIsoServiceAutoscalerPropsInitializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportEcsIsoServiceAutoscalerPropsecs_iso_service_autoscaler_props=EcsIsoServiceAutoscalerProps(...)PropertiesNameTypeDescriptionecsClusteraws-cdk-lib.aws_ecs.ClusterThe cluster the service you wish to scale resides in.ecsServiceaws-cdk-lib.aws_ecs.IServiceThe ECS service you wish to scale.scaleAlarmaws-cdk-lib.aws_cloudwatch.AlarmBaseThe Cloudwatch Alarm that will cause scaling actions to be invoked, whether it's in or not in alarm will determine scale up and down actions.maximumTaskCountnumberThe maximum number of tasks that the service will scale out to.minimumTaskCountnumberThe minimum number of tasks the service will have.roleaws-cdk-lib.aws_iam.IRoleOptional IAM role to attach to the created lambda to adjust the desired count on the ECS Service.scaleInCooldownaws-cdk-lib.DurationHow long will the application wait before performing another scale in action.scaleInIncrementnumberThe number of tasks that will scale in on scale in alarm status.scaleOutCooldownaws-cdk-lib.DurationHow long will a the application wait before performing another scale out action.scaleOutIncrementnumberThe number of tasks that will scale out on scale out alarm status.ecsClusterRequired# Example automatically generated from non-compiling source. May contain errors.ecsCluster:Cluster;Type:aws-cdk-lib.aws_ecs.ClusterThe cluster the service you wish to scale resides in.ecsServiceRequired# Example automatically generated from non-compiling source. May contain errors.ecsService:IService;Type:aws-cdk-lib.aws_ecs.IServiceThe ECS service you wish to scale.scaleAlarmRequired# Example automatically generated from non-compiling source. May contain errors.scaleAlarm:AlarmBase;Type:aws-cdk-lib.aws_cloudwatch.AlarmBaseThe Cloudwatch Alarm that will cause scaling actions to be invoked, whether it's in or not in alarm will determine scale up and down actions.Note: composite alarms can not be generated with CFN in all regions, while this allows you to pass in a composite alarm alarm creation is outside the scope of this constructmaximumTaskCountOptional# Example automatically generated from non-compiling source. May contain errors.maximumTaskCount:number;Type:numberDefault:10The maximum number of tasks that the service will scale out to.Note: This does not provide any protection from scaling out above the maximum allowed in your account, set this variable and manage account quotas appropriately.minimumTaskCountOptional# Example automatically generated from non-compiling source. May contain errors.minimumTaskCount:number;Type:numberDefault:1The minimum number of tasks the service will have.roleOptional# Example automatically generated from non-compiling source. May contain errors.role:IRole;Type:aws-cdk-lib.aws_iam.IRoleDefault:A role is created for you with least privilege IAM policyOptional IAM role to attach to the created lambda to adjust the desired count on the ECS Service.Ensure this role has appropriate privileges. Example IAM policy statements:{"PolicyDocument":{"Statement":[{"Action":"cloudwatch:DescribeAlarms","Effect":"Allow","Resource":"*"},{"Action":["ecs:DescribeServices","ecs:UpdateService"],"Condition":{"StringEquals":{"ecs:cluster":"arn:${Partition}:ecs:${Region}:${Account}:cluster/${ClusterName}"}},"Effect":"Allow","Resource":"arn:${Partition}:ecs:${Region}:${Account}:service/${ClusterName}/${ServiceName}"}],"Version":"2012-10-17"}}scaleInCooldownOptional# Example automatically generated from non-compiling source. May contain errors.scaleInCooldown:Duration;Type:aws-cdk-lib.DurationDefault:60 secondsHow long will the application wait before performing another scale in action.scaleInIncrementOptional# Example automatically generated from non-compiling source. May contain errors.scaleInIncrement:number;Type:numberDefault:1The number of tasks that will scale in on scale in alarm status.scaleOutCooldownOptional# Example automatically generated from non-compiling source. May contain errors.scaleOutCooldown:Duration;Type:aws-cdk-lib.DurationDefault:60 secondsHow long will a the application wait before performing another scale out action.scaleOutIncrementOptional# Example automatically generated from non-compiling source. May contain errors.scaleOutIncrement:number;Type:numberDefault:1The number of tasks that will scale out on scale out alarm status.PopulateWithConfigPropsInitializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportPopulateWithConfigPropspopulate_with_config_props=PopulateWithConfigProps(...)PropertiesNameTypeDescriptionlocalRouteTableIdstringLocal route table ID, with routes only to local VPC.privateRouteTableIdstringRoute table ID for a provided route table with routes to enterprise network.subnetConfigSubnetConfig[]List of Subnet configs to provision to provision.vpcIdstringID of the VPC provided that needs to be populated.localRouteTableIdRequired# Example automatically generated from non-compiling source. May contain errors.localRouteTableId:string;Type:stringLocal route table ID, with routes only to local VPC.privateRouteTableIdRequired# Example automatically generated from non-compiling source. May contain errors.privateRouteTableId:string;Type:stringRoute table ID for a provided route table with routes to enterprise network.Both subnetType.PUBLIC and subnetType.PRIVATE_WITH_EGRESS will use this propertysubnetConfigRequired# Example automatically generated from non-compiling source. May contain errors.subnetConfig:SubnetConfig[];Type:SubnetConfig[]List of Subnet configs to provision to provision.vpcIdRequired# Example automatically generated from non-compiling source. May contain errors.vpcId:string;Type:stringID of the VPC provided that needs to be populated.RemoveTagsPropsInitializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportRemoveTagsPropsremove_tags_props=RemoveTagsProps(...)PropertiesNameTypeDescriptioncloudformationResourcestringName of Cloudformation resource Type (e.g. 'AWS::Lambda::Function').tagPropertyNamestringName of the tag property to remove from the resource.cloudformationResourceRequired# Example automatically generated from non-compiling source. May contain errors.cloudformationResource:string;Type:stringName of Cloudformation resource Type (e.g. 'AWS::Lambda::Function').tagPropertyNameOptional# Example automatically generated from non-compiling source. May contain errors.tagPropertyName:string;Type:stringDefault:TagsName of the tag property to remove from the resource.ResourceExtractorPropsInitializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportResourceExtractorPropsresource_extractor_props=ResourceExtractorProps(...)PropertiesNameTypeDescriptionextractDestinationStackaws-cdk-lib.StackStack to move found extracted resources into.resourceTypesToExtractstring[]List of resource types to extract, ex:AWS::IAM::Role.stackArtifactsaws-cdk-lib.cx_api.CloudFormationStackArtifact[]Synthed stack artifacts from your CDK app.additionalTransforms{[ key: string ]: string}Additional resource transformations.valueShareMethodResourceExtractorShareMethodThe sharing method to use when passing exported resources from the "Extracted Stack" into the original stack(s).extractDestinationStackRequiredextractDestinationStack:Stack;Type:aws-cdk-lib.StackStack to move found extracted resources into.resourceTypesToExtractRequired# Example automatically generated from non-compiling source. May contain errors.resourceTypesToExtract:string[];Type:string[]List of resource types to extract, ex:AWS::IAM::Role.stackArtifactsRequired# Example automatically generated from non-compiling source. May contain errors.stackArtifacts:CloudFormationStackArtifact[];Type:aws-cdk-lib.cx_api.CloudFormationStackArtifact[]Synthed stack artifacts from your CDK app.additionalTransformsOptional# Example automatically generated from non-compiling source. May contain errors.additionalTransforms:{[key:string]:string}Type:{[ key: string ]: string}Additional resource transformations.valueShareMethodOptional# Example automatically generated from non-compiling source. May contain errors.valueShareMethod:ResourceExtractorShareMethod;Type:ResourceExtractorShareMethodThe sharing method to use when passing exported resources from the "Extracted Stack" into the original stack(s).SetApiGatewayEndpointConfigurationPropsInitializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportSetApiGatewayEndpointConfigurationPropsset_api_gateway_endpoint_configuration_props=SetApiGatewayEndpointConfigurationProps(...)PropertiesNameTypeDescriptionendpointTypeaws-cdk-lib.aws_apigateway.EndpointTypeAPI Gateway endpoint type to override to.endpointTypeOptional# Example automatically generated from non-compiling source. May contain errors.endpointType:EndpointType;Type:aws-cdk-lib.aws_apigateway.EndpointTypeDefault:EndpointType.REGIONALAPI Gateway endpoint type to override to.Defaults to EndpointType.REGIONALSplitVpcEvenlyPropsInitializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportSplitVpcEvenlyPropssplit_vpc_evenly_props=SplitVpcEvenlyProps(...)PropertiesNameTypeDescriptionrouteTableIdstringRoute Table ID that will be attached to each subnet created.vpcCidrstringCIDR range of the VPC you're populating.vpcIdstringID of the existing VPC you're trying to populate.cidrBitsstringcidrBitsargument for theFn::CidrCloudformation intrinsic function.numberOfAzsnumberNumber of AZs to evenly split into.subnetTypeaws-cdk-lib.aws_ec2.SubnetTypeNo description.routeTableIdRequired# Example automatically generated from non-compiling source. May contain errors.routeTableId:string;Type:stringRoute Table ID that will be attached to each subnet created.vpcCidrRequired# Example automatically generated from non-compiling source. May contain errors.vpcCidr:string;Type:stringCIDR range of the VPC you're populating.vpcIdRequired# Example automatically generated from non-compiling source. May contain errors.vpcId:string;Type:stringID of the existing VPC you're trying to populate.cidrBitsOptional# Example automatically generated from non-compiling source. May contain errors.cidrBits:string;Type:stringDefault:'6'cidrBitsargument for theFn::CidrCloudformation intrinsic function.numberOfAzsOptional# Example automatically generated from non-compiling source. May contain errors.numberOfAzs:number;Type:numberDefault:3Number of AZs to evenly split into.subnetTypeOptional# Example automatically generated from non-compiling source. May contain errors.subnetType:SubnetType;Type:aws-cdk-lib.aws_ec2.SubnetTypeDefault:subnetType.PRIVATESubnetConfigInitializer# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportSubnetConfigsubnet_config=SubnetConfig(...)PropertiesNameTypeDescriptionavailabilityZonestringWhich availability zone the subnet should be in.cidrRangestringCidr range of the subnet to create.groupNamestringLogical group name of a subnet.subnetTypeaws-cdk-lib.aws_ec2.SubnetTypeWhatSubnetTypeto use.availabilityZoneRequired# Example automatically generated from non-compiling source. May contain errors.availabilityZone:string;Type:stringWhich availability zone the subnet should be in.cidrRangeRequired# Example automatically generated from non-compiling source. May contain errors.cidrRange:string;Type:stringCidr range of the subnet to create.groupNameRequired# Example automatically generated from non-compiling source. May contain errors.groupName:string;Type:stringLogical group name of a subnet.Example# Example automatically generated from non-compiling source. May contain errors.dbsubnetTypeRequired# Example automatically generated from non-compiling source. May contain errors.subnetType:SubnetType;Type:aws-cdk-lib.aws_ec2.SubnetTypeWhatSubnetTypeto use.This will govern theaws-cdk:subnet-typetag on the subnetSubnetTypeaws-cdk:subnet-typetag valuePRIVATE_ISOLATED'Isolated'PRIVATE_WITH_EGRESS'Private'PUBLIC'Public'ClassesAddCfnInitProxyImplements:aws-cdk-lib.IAspectAdd proxy configuration to Cloudformation helper functions.Initializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportAddCfnInitProxyAddCfnInitProxy(props,AddCfnInitProxyProps)NameTypeDescriptionpropsAddCfnInitProxyPropsNo description.propsRequiredType:AddCfnInitProxyPropsMethodsNameDescriptionvisitAll aspects can visit an IConstruct.visit# Example automatically generated from non-compiling source. May contain errors.visit(node,IConstruct)All aspects can visit an IConstruct.nodeRequiredType:constructs.IConstructAddLambdaEnvironmentVariablesImplements:aws-cdk-lib.IAspectAdd one or more environment variables toalllambda functions within a scope.Initializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportAddLambdaEnvironmentVariablesAddLambdaEnvironmentVariables(props,{"key":string,"string":string})NameTypeDescriptionprops{[ key: string ]: string}: string} props - Key Value pair(s) for environment variables to add to all lambda functions.propsRequiredType:{[ key: string ]: string}: string} props - Key Value pair(s) for environment variables to add to all lambda functions.MethodsNameDescriptionvisitAll aspects can visit an IConstruct.visit# Example automatically generated from non-compiling source. May contain errors.visit(node,IConstruct)All aspects can visit an IConstruct.nodeRequiredType:constructs.IConstructAddPermissionBoundaryImplements:aws-cdk-lib.IAspectA patch for Adding Permissions Boundaries to all IAM roles.Additional options for adding prefixes to IAM role, policy and instance profile namesCan account for non commercial partitions (e.g. aws-gov, aws-cn)Initializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportAddPermissionBoundaryAddPermissionBoundary(props,AddPermissionBoundaryProps)NameTypeDescriptionpropsAddPermissionBoundaryPropsNo description.propsRequiredType:AddPermissionBoundaryPropsMethodsNameDescriptioncheckAndOverrideNo description.visitAll aspects can visit an IConstruct.checkAndOverride# Example automatically generated from non-compiling source. May contain errors.check_and_override(node,CfnResource,prefix,string,length,number,cfn_prop,string,cdkProp?:string)nodeRequiredType:aws-cdk-lib.CfnResourceprefixRequiredType:stringlengthRequiredType:numbercfnPropRequiredType:stringcdkPropOptionalType:stringvisit# Example automatically generated from non-compiling source. May contain errors.visit(node,IConstruct)All aspects can visit an IConstruct.nodeRequiredType:constructs.IConstructConvertInlinePoliciesToManagedImplements:aws-cdk-lib.IAspectPatch for turning all Policies into ConvertInlinePoliciesToManaged.Some users have policies in place that make it impossible to create inline policies. Instead,
they must use managed policies.Note that order matters with this aspect. Specifically, it should generally be added first.
This is because other aspects may add overrides that would be lost if applied before
this aspect since the original aspect is removed and replaced.Example# Example automatically generated from non-compiling source. May contain errors.# Replace all AWS::IAM::Policy resources with equivalent AWS::IAM::ManagedPolicyAspects.of(stack).add(ConvertInlinePoliciesToManaged())Initializersfromcdklabs.cdk_enterprise_iacimportConvertInlinePoliciesToManagedConvertInlinePoliciesToManaged()NameTypeDescriptionMethodsNameDescriptionvisitAll aspects can visit an IConstruct.visit# Example automatically generated from non-compiling source. May contain errors.visit(node,IConstruct)All aspects can visit an IConstruct.nodeRequiredType:constructs.IConstructRemovePublicAccessBlockConfigurationImplements:aws-cdk-lib.IAspectLooks for S3 Buckets, and removes thePublicAccessBlockConfigurationproperty.For use in regions where Cloudformation doesn't support this propertyInitializersfromcdklabs.cdk_enterprise_iacimportRemovePublicAccessBlockConfigurationRemovePublicAccessBlockConfiguration()NameTypeDescriptionMethodsNameDescriptionvisitAll aspects can visit an IConstruct.visit# Example automatically generated from non-compiling source. May contain errors.visit(node,IConstruct)All aspects can visit an IConstruct.nodeRequiredType:constructs.IConstructRemoveTagsImplements:aws-cdk-lib.IAspectPatch for removing tags from a specific Cloudformation Resource.In some regions, the 'Tags' property isn't supported in Cloudformation. This patch makes it easy to removeExample# Example automatically generated from non-compiling source. May contain errors.# Remove tags on a resourceAspects.of(stack).add(RemoveTags(cloudformation_resource="AWS::ECS::Cluster"))# Remove tags without the standard 'Tags' nameAspects.of(stack).add(RemoveTags(cloudformation_resource="AWS::Backup::BackupPlan",tag_property_name="BackupPlanTags"))Initializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportRemoveTagsRemoveTags(props,RemoveTagsProps)NameTypeDescriptionpropsRemoveTagsPropsNo description.propsRequiredType:RemoveTagsPropsMethodsNameDescriptionvisitAll aspects can visit an IConstruct.visit# Example automatically generated from non-compiling source. May contain errors.visit(node,IConstruct)All aspects can visit an IConstruct.nodeRequiredType:constructs.IConstructResourceExtractorImplements:aws-cdk-lib.IAspectThis Aspect takes a CDK application, all synthesized CloudFormationStackArtifact, a value share method, and a list of Cloudformation resources that should be pulled out of the main CDK application, which should be synthesized to a cloudformation template that an external team (e.g. security team) to deploy, and adjusting the CDK application to reference pre-created resources already pulled out.Example# Example automatically generated from non-compiling source. May contain errors.app=App()stack=Stack(app,"MyStack")extracted_stack=Stack(app,"ExtractedStack")synthed_app=app.synth()Aspects.of(app).add(ResourceExtractor(extract_destination_stack=extracted_stack,stack_artifacts=synthed_app.stacks,value_share_method=ResourceExtractorShareMethod.CFN_OUTPUT,resource_types_to_extract=["AWS::IAM::Role","AWS::IAM::Policy","AWS::IAM::ManagedPolicy","AWS::IAM::InstanceProfile"]))app.synth(force=True)Initializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportResourceExtractorResourceExtractor(props,ResourceExtractorProps)NameTypeDescriptionpropsResourceExtractorPropsNo description.propsRequiredType:ResourceExtractorPropsMethodsNameDescriptionvisitEntrypoint.visit# Example automatically generated from non-compiling source. May contain errors.visit(node,IConstruct)Entrypoint.nodeRequiredType:constructs.IConstructSetApiGatewayEndpointConfigurationImplements:aws-cdk-lib.IAspectOverride RestApis to use a set endpoint configuration.Some regions don't support EDGE endpoints, and some enterprises require
specific endpoint types for RestApisInitializers# Example automatically generated from non-compiling source. May contain errors.fromcdklabs.cdk_enterprise_iacimportSetApiGatewayEndpointConfigurationSetApiGatewayEndpointConfiguration(props?:SetApiGatewayEndpointConfigurationProps)NameTypeDescriptionpropsSetApiGatewayEndpointConfigurationPropsNo description.propsOptionalType:SetApiGatewayEndpointConfigurationPropsMethodsNameDescriptionvisitAll aspects can visit an IConstruct.visit# Example automatically generated from non-compiling source. May contain errors.visit(node,IConstruct)All aspects can visit an IConstruct.nodeRequiredType:constructs.IConstructEnumsProxyTypeWhether an http-proxy or https-proxy.MembersNameDescriptionHTTP--http-proxy.HTTPS--https-proxy.HTTP-http-proxy.HTTPS-https-proxy.ResourceExtractorShareMethodThe available value sharing methods to pass values from the extracted stack onto the original stack(s).MembersNameDescriptionCFN_OUTPUTNo description.SSM_PARAMETERNo description.API_LOOKUPNo description.CFN_OUTPUTSSM_PARAMETERAPI_LOOKUPResourceTransformMembersNameDescriptionSTACK_NAMENo description.LOGICAL_IDNo description.STACK_NAMELOGICAL_ID