Package: cdklabs.cdk-ssm-documents
SSM Document CDKThis library provides a code-based utility for implementing SSM Documents. The SSM Document objects can be used to print YAML/JSON documents and to mimic document processing locally.This library abstracts SSM Documents at a high level, with each step as well as the document itself being objects. The properties needed to build these objects correlate to the settings that apply to them, making them simple to make.
This library can be used to test your document locally before deploying it to SSM.Since the library is written in JSII, it can be exported to other languages that support JSII (Java, Python).This is what you'd use if you wanted to:The ability to test without deploying resources or executing an actual SSM on AWS.Reusability of steps between documents by reusing existing itemsCreate logical higher-level groupings of reusable groups of steps ("Patterns")Simple to use interface for writing documentsImport existing documents from a file (or string) and mimic them locally to test them.UsageDocument CreationTypescript usage (Execute AWS API Step)...
The below creates the AutomationDocument in an AWS CDK stack.import{AutomationDocument}from'./automation-document';exportclassHelloWorldextendsStack{constructor(app:Construct,id:string){super(app,id);//CreateAutomationDocumentconstmyDoc=newAutomationDocument(this,"MyDoc",{documentFormat:DocumentFormat.JSON,documentName:"MyDoc",docInputs:[Input.ofTypeString('MyInput',{defaultValue:'a'})],});//Defineyoursteps...myDoc.addStep(newPauseStep(this,"MyPauseStep",{name:"MyPauseStep",explicitNextStep:StepRef.fromName("step1")//Optional(willdefaulttonextaddedstep)}));myDoc.addStep(newExecuteScriptStep(this,"MyExecuteStep",{name:"step1",language:ScriptLanguage.python(PythonVersion.VERSION_3_6,'my_func'),code:ScriptCode.fromFile(resolve("test/test_file.py")),//ORScriptCode.inline("def my_func(args, context):\nreturn {'MyReturn': args['MyInput'] + '-suffix'}\n"),outputs:[{outputType:DataTypeEnum.STRING,name:"MyFuncOut",selector:"$.Payload.MyReturn"}],onFailure:OnFailure.abort(),inputPayload:{MyInput:StringVariable.of('MyInput')},}));}}Document JSON/YAML Export as YAML/JSONYou can deploy the above document using CDK.
To print the above document object as a JSON (or YAML), do the following:constmyDocJson=myDoc.print();//PrintYAMLbysettingthedocumentFormattoYAMLDocument SimulationTo run the document object in simulation mode, use the below. Simulation mode does NOT hit the SSM API, rather it mimics the execution that will happen in an SSM execution. The run happens locally and allows you to mock the calls to external services (AWS APIs for example) or to invoke those services using your local credentials.import{Simulation}from'./simulation';constmyDocJson=Simulation.ofAutomation(myDoc,{}).simulate({MyInput:"FooBar"});Command DocumentsBelow is an example of how to use the library to create Command documents.
Simulation for command documents is not yet supported for all command plugins.
You can use a Docker image/container as a playground for testing the Command document execution for the supported plugins.In this example there is a complete CDK stack. Notice that theCommandDocumentis saved as a field so that it can be tested from the test code.exportclassHelloCdkStackextendsStack{readonlymyCommandDoc:CommandDocument;constructor(scope:Construct,id:string,props?:StackProps){super(scope,id,props);this.myCommandDoc=newCommandDocument(this,"MyCommandDoc",{docInputs:[Input.ofTypeString('FirstCommand',{defaultValue:'a'})],})construnScriptStep=newRunShellScriptStep(this,"MyShellScript",{runCommand:[StringVariable.of("FirstCommand"),HardCodedString.of("mkdir asdf"),],});this.myCommandDoc.addStep(runScriptStep);}}Below is an example of how you would run a simulation against the aboveCommandDocument.Currently,bashmust be available in the container or the executions against the docker will not succeed.test('Test command doc',()=>{constapp=newcdk.App();conststack=newHelloCdk.HelloCdkStack(app,'MyTestStack');//1.$dockerpullamazonlinux//2.$dockerrun-diamazonlinuxconstsimulation=Simulation.ofCommand(stack.myCommandDoc,{simulationPlatform:Platform.LINUX,environment:DockerEnvironment.fromContainer('MY_CONTAINER_ID')});simulation.simulate({FirstCommand:'mkdir foobar'})//3.Thedocumentshouldrunthefirstcommand(create'foobar')andcreatefile'asdf'//4.$dockerexec-it<containername>bash//5.Ensurethat'asdf'and'foobar'werewrittento/tmp});Patterns (High-Level Constructs)In typical CDK style, you can assemble often used groups of steps into higher level Constructs.Consider if you typically create AutomationDocuments that start with logging the time and end with logging the total time taken. You can create a high-level Automation Document and extend that when you implement an Automation.See theTimedDocumentclass to see such implementation.Or consider the case of multiple steps that are always run together such as rebooting and instance and waiting for it to be active.The below example is copied from theRebootInstanceAndWaitclass:exportclassRebootInstanceAndWaitextendsCompositeAutomationStep{readonlyreboot:AwsApiStep;readonlydescribe:WaitForResourceStep;constructor(scope:Construct,id:string,instanceId:IStringVariable){super(scope,id);this.reboot=newAwsApiStep(this,'RebootInstances',{service:AwsService.EC2,pascalCaseApi:'RebootInstances',apiParams:{InstanceIds:[instanceId]},outputs:[],});this.describe=newWaitForResourceStep(this,'DescribeInstances',{service:AwsService.EC2,pascalCaseApi:'DescribeInstances',apiParams:{InstanceIds:[instanceId]},selector:'$.Reservations[0].Instances[0].State.Name',desiredValues:['running'],});}addToDocument(doc:AutomationDocumentBuilder):void{doc.addStep(this.reboot);doc.addStep(this.describe);}}Now, you can useRebootInstanceAndWaitas a step in a document and the child steps will be included.Existing DocumentsDo you have an existing document that you want to convert to code and/or test locally using the simulation?Import Existing DocumentHere is an example of how you can import an existing document and then simulate it locally with mocked AWS resources://InitializeMocksconstsleeper=newMockSleep();constawsInvoker=newMockAwsInvoker();awsInvoker.whenThen(//wheninvokedwith...{awsApi:'listBuckets',awsParams:{},service:AwsService.S3},//thenresponsewith...{Owner:{ID:"BUCKET_ID"}})//======>Createdocumentfromfile<=======conststack:Stack=newStack();constmyAutomationDoc=StringDocument.fromFile(stack,"MyAutomationDoc",'test/myAutomation.json',{//======================});//ExecutesimulationconstsimOutput=Simulation.ofAutomation(myAutomationDoc,{sleepHook:sleeper,awsInvoker:awsInvoker}).simulate({});//Assertsimulationresultassert.deepEqual(awsInvoker.previousInvocations,[{awsApi:'listBuckets',awsParams:{},service:AwsService.S3}]);assert.deepEqual(sleeper.sleepMilliInvocations,[3000]);assert.deepEqual(simOutput.outputs['simulationSteps'],['MySleep','GetBucketId']);Import Existing StepsYou can also grab a string step (or steps) and import them as CDK step constructs.
This can be used to convert existing documents into CDK with each step defined separately.
Doing so will allow you do modify steps and reuse them in other documents.Here's a simple example of a sleep step copy and pasted from its original yaml:StringStep.fromYaml(this,`name:sleepaction:aws:sleepinputs:Duration:PT0M`,{});The above will return the CDK construct SleepStep.Incident ManagerThis library provides L2 constructs for IncidentResponse as follows:newIncidentResponse(this,"MyIncidentResponsePlan",{incidentTemplate:IncidentTemplate.critical('EC2 Instance Utilization Impacted',{summary:'EC2 Instance Impacted'}),actions:[IncidentResponseAction.ssmAutomation(myAutomationDoc,ec2CwAlarmRole,{parameters:{IncidentRecordArn:StringVariable.of('INCIDENT_RECORD_ARN'),InvolvedResources:StringVariable.of('INVOLVED_RESOURCES'),AutomationAssumeRole:HardCodedString.of(ec2CwAlarmRole.roleArn),}})]});Notice how themyAutomationDocis specified which is a reference to an AutomationDocument created using this library.What is Planned?This library currently contains AutomationDocument and CommandDocument steps.
Simulation for AutomationDocuments is fully supported. Simulation for CommandDocuments is limited.Stay tuned!Related Projectshttps://github.com/udondan/cdk-ssm-documentSecuritySeeCONTRIBUTINGfor more information.LicenseThis project is licensed under the Apache-2.0 License.