Package: paco.models
paco.modelsAn object model for semantic cloud infrastructure.paco.modelsparses a directory of YAML files that compose an Paco project and loads them
into a complete object model.What's in the model?The model defines common logical cloud infrastructure concepts, such as networks, accounts,
applications and environments.The model uses network and applications as hierarchical trees of configuration that can
have their values over rode when they are placed into environments. Environments live in a
network and contain applications, and typically represent the stages of the software development
lifecycle (SDLC), such as 'development', 'staging' and 'production'.The model has a declarative schema that explicitly defines the fields for each object type in the model.
This schema declares not only type (e.g. string, integer) but can also declare defaults, min and max values,
constrain to specific values, and define invariants that ensure that if one field has a specific value, another
fields value is compatabile with that. The model will validates these fields when it loads a Paco project.DevelopingInstall this package with your Python tool of choice. Typically set-up a virtualenv
and pip install the dependencies in there:python -m venv env

./env/bin/pip install -e .There are unit tests using PyTest. If you are using VS Code you can turn on the
"Py Test Enabled" setting and run "Discover Unit Tests" command.Generated VocabularyThe modulepaco.models.gen_vocabularyis dynamically generated by the scriptpaco_update_gen_vocabulary.To run this script first install the paco.models (pip install -e .) project. Then create an IAM User in
an active AWS account with read-only access and save them in your.aws/credentialsfile. If you aren't
using the default profile name, you can set the AWS_PROFILE environment variable.The paco.models will create a handy profile.sh to set this up for you:$ source profile.shSetup your AWS Credentials$ export AWS_DEFAULT_PROFILE=Then simple run the command from the command line after sourcing profile.sh:$ paco_update_gen_vocabularyChangelog for paco.models7.8.36 (2023-12-21)Removed ECS SErvice tracking policy predefined metric's required flag7.8.35 (2023-09-26)AddedAdded ECRReplicationConfiguration resourceAdded external_resource to GuardDutyDetectorRegionAdded secrets_manager_default_2023_03_09 and ecs_tracking_policy_name_2023_08_29 legacy flags.ECR Repository ReplicationChanged Amazon Linux live patching Release Version field to required.Implemented Live Amazon Linux 2023 OS and Kernel patching and version preservation.Initalized command and entry_point lists in ECSContainerDefinition7.8.34 (2023-07-19)AddedAdded Task role to ECS services7.8.33 (2023-06-27)AddedAdded CloudWatch Logs resourceAdded CrossZone configuration to ILoadBalancerAdded EventBridge ResourceAdded LBNetwork to vocabulary fileAdded NACL configuration support to SegmentsAdded RuleOverrideAction to WAFWebACL RulesAdded Sid field to the policy Statement() model objectAdded WebACL support to ALB ListenersAdded disable_account_delegates to IAMUser to allow users to be created in any accountAdded event_bus field to IEventsRuleAdded get_arn() function to CloudWatchLogGroup model objectAdded managed_policy_arns filed to the IAM User Custom Policy model objectAdded manged_polcies support to IAM users to attach policies directly to the user.Added me-central-1 (UAE) to vocabulary fileAdded override_action to WAF RuleAdded support for Amazon Linux 2023Aded Aurora Global Cluster support to RDSBegan implementing Lambda FunctionURLChanged LoadBalacner ListenerRule 'host' field to a list.Disabled list merging during dict merge in the loaderFixedFixed PacoReference str_ok when used in ListsFixed a bug with lists in the paco model loader that have paco.ref references in them.ChangedModified SecurityGroupRule cidr_ip type to PacoReference from TextLineRegenerated VocabularyUpdated vocabulary7.8.32 ((2023-02-28))AddedAdded ARM support for Amazon linux instance type for t4g instancsAdded AccessKeys IAM User permissionsAdded AppConfig resourceAdded CloudWatch Resource for Consolidated Monitoring Account configurationAdded Conditions to AssumeRolePolicyAdded EC2 Flow Logs for VPCAdded EC2 Flow Logs for VPCAdded EIP configuration to EC2 global resourceAdded EIPs to paco ref resolutionsAdded GuardDuty ResourceAdded IAMPolicy ResourceAdded Idenity Provider role to ECR RepositoriesAdded Identity Provider Roles to Lambda functions.Added Image Scanning supprot to ECRRepositoryAdded Inspector ResourceAdded Lifecycle Rules support to S3BucketsAdded Monitoring to GuardDutyAdded PacoService IResourceAdded ReadOnly mode to EFS mountsAdded Reference Outputs lookupsAdded ResponseHeaderPolicy to CloudFront resources.Added Roles to resource.iamAdded Ubuntu 22.04 support to paco.ref ami functionAdded VPCEIP to network.vpc configuration.Added VPN Client Endpoint to VPCAdded a filter to remove Nones from any lists to clean up list merges.Added ability for ECS services to override the LogGroup name, and added a boolean to disbale LogGroup creation.Added ability for VPC Peering to associate the private hosted zone of the acceptor with the requesterAdded account field to ILambdaAdded assume_role_policies to BaseRole to allow for multi-statement AssumeRole policies.Added availability zone field to VPN client endpoint.Added codedeploy_stack_name_2022_07_07 as a legacy flagAdded config_scope arg to the loaderAdded external_repository_arn to ECSRepository resourcesAdded externally_managed field to IAM User access keys to allow users to manage their own keys.Added federated to Principal schemaAdded full_repository_name to ECRRepositoryAdded hash_long_names to get_aws_name() LoadBalancer model objectAdded ignore changes field to Loadbalancer ListenerRule target groupAdded ignore fields to ECSContainer Definitions and individual servicsAdded ignore_image_changes and ignore_capacity_changes to ECSServices configAdded input_artifact_action to support parallel action runs in CodePipelineAdded lambda_version to CloudFront lambda function associationsAdded policy_actions, the ability to control Access to IDPRolesAdded region support to References for CloudWatch ResourcesAdded response_headers_policy_id to CloudFront Default cache behaviorAdded support for gloabl EIPs to self-managed EC2 nat gatewaysAdded support to set the NAT instance AMIAdded t4g instance types to vocabulary.Added tags field to IEBSAdded ubuntu-18 AMI function call lookupAdding AWSLog config for ECSLoggingAdding EIPs config to EC2 resource.Allowed ARNs in LBApplication listener ssl_certificates listsChanged resource.iam.roles account string to accounts list.FixedFixed Outputs cache by separating netenv, server, resource, etc.Fixed Outputs cache by separating netenv, server, resource, etc.Fixed Route53 HostedZone invariant for private hosted zones when external resource is enabled.Fixed amazon-linux-nat ec2 function filter.Fixed amazon-linux-nat ec2 function filter.Fixed error in loader when filtering out None's from merged listsFixed error in loader when filtering out None's from merged listsFixed model_obj on resource.route53 pathsFixed monitoring notification group filteringChangedImplemented VPC VPN Client EndpointMade ECSASGConfiguration DeployablePorting to troposphere 4.xPrefix cp- to ECS Capacity provider names if they start with aws, ecs, or fargatRemoved breakpoint() calls.Started adding Identity Provider support to Base Roles7.8.31 ((2022-07-08))AddedAdded ALB Listener Default ActionsAdded PacoServiceHook to IS3BucketAdded Postgres 12.11 to generated vocabularyAdded S3 Registry HooksAdded a feature_flag option to project.yamlAdded get_object() function to Reference() to return reference's objectAdded paco.ref alias...: key functionalityAdded prefix_environment_name and new logic to ECR Repository name generation and configAdded resolve_from_outputs to get_resolve_ref_obj() in referencesAdded s3_buckets to ILambda for explicit Lambda Permission to InvokeFunctionAdded to_dict() to AlarmNotifications() model objectAdded to_dict() to AlarmNotifications() model objectFixedFixed None reference in metricsFixed generated service config to allow paco_service_hooks without a config7.8.30 ((2022-06-02))AddedAdded build artifacts to .gitignoreAdded build artifacts to .gitignoreAdded netenv helepr functions to Reference()Added support for duplicated appliactions to generated service configAdded windows_2016 to vocabulary7.8.29 ((2022-05-25))AddedAdded gen_name() to Rerference() for generating a commonly unique nameAdded support to normalize refs in sevice generated configurations.Added support to normalize refs in sevice generated configurations.Made gp3 the default EBS Volume TypeNew defaults for ALB and CloudFront security Policies7.8.28 (2022-05-06)AddedAdded LoadBalancer and TargetGroup automated support to AlarmsAdded enable/disbale to ITargetGroupAdded monitoring to ITargetGroup7.8.27 (2022-05-01)ChangedTesting PyPi Build and Upload7.8.26 (2022-05-01)ChangedTesting PyPi Build and UPload7.8.25 (2022-05-01)AddedImplemented a default_password field for IAM users to work around password resctriptions.Added cost_disabled field to ILoadBalancer to allow ALB's to be disabledAdded default of 30 days to ICloudWatchLogRetention()Added get_aws_name() to LoadBalancersAdded support for CostDisabled ALBSAdded project Environment Variables support to CodeBuild.Added GitHub CodeStar connection supportAdded DetectChanges to DeploymentPipelinesImplemented new PacoServiceHookAdded netenv support to paco.ref aliasAdded resolve_from_outputs boolean to force outputs lookupAdded more CodeDeploy Service hooks to implement Blue/Green deploymentsAdded Service Hook schema for CodeDeploy action in Deployment PipeliensFixedFixed error with alias and service process callbacks in the loader.FIxed LogGroup expiry defaultsChangedStarted looking at AWS layersRemoved requirement for IDeploymentPipelineCodeStarConnectionSourceAction owner and repository fields.7.8.24 (2022-03-25)ChangedSeparated FilePermissions for group, owner, and mode configurationAddedAdded LifeCycle Policies to ECRRepository resources.Added ubuntu_20 to instance_ami paco.ref functionAdded support for CIS hardened Ubuntu 18 AMI paco.ref functionAdded event bridge notification access to SNS topcisAdded Event Pattern support to EventsRulesAdded notifications to EventsRulesAdded CodeStar connection ARN field to CodePipeline source configuration for BitBucket.7.8.23 (2022-03-04)FixedFixed IRDSClusterInstances taggedValue arguments.AddedAdded DNS to ElastiCacheAdded Environment Type to CodeBuild DeploymentPipelie configurationAdded Alias feature for consolidating commonly modified configuration in one locationAdded get_environment_name method to Reference()7.8.22 (2022-02-09)AddedAdded Build Batch configuration to CodeBuild7.8.21 (2022-02-08)AddedAdded github source configration to CodeBuildAdded enable_automatic_backups to IEFSFixedFixed the loader's get_all_nodes() from 'if obj:' returning False when it is a valid obj.ChangedEnabled encryption at rest on EFS by default7.8.20 (2022-01-31)AddedAdded CodeBuild Artifacts configuration7.8.19 (2022-01-27)AddedAdded deployment_branch_name to CodeBuild GitHub source configurationAdded source_security_group_owner to ISecurityGroup for cross account accessAdded peer_type to Peering configAdded vpc_config configuration to codebuildAdded availability_zone to VPC Endpoints configuration.FixedFixed up VPC Peering between netenvsFixed get_resolve_ref_obj if value is an integer7.8.18 (2021-12-17)ChangedUpdated generated vocabulary.AddedImplemented IAM Role resources7.8.17 (2021-11-24)AddedAdded 'disable_codepipeline' to IDeploymentPipelineConfiguration to allow stage resource to be build independently.Added CodeBuild GitHub source configuration7.8.16 (2021-11-23)ChangedModified IECSService's deployment_minimum_healthy_percent minimum from 1 to 0.AddedAdded namespace by metric vocabulary lookup to automate ASG namespaces for CWAgent and AWS/EC2Added region to ILambda resource.Implemented SystemsManagerSession IAM delegates policyAdded ManualApproval to isPacoDeploymentPipelinePermissionPolicyValid for IAM permissions.Added AAAA to Route53 Record set typesAdded ubuntu_18_cis ami_type to vocabulary7.8.15 (2021-10-04)AddedAdded import_from logic for CodeCommitAdded TLSv1.2_2021 minimum cloudfront protocol version7.8.14 (2021-09-10)ChangedUpdated generated vocabularyAddedAdded Security Groups service hooks to the registryAdded SPF Route53 RecordSet type to validationAdded HealthCheckPort to load balancersAdded WAFv2 WebACL Resource7.8.13 (2021-08-26)AddedAdded bucket_owner_preferred boolean to S3Bucket resourcesImplemented S3 Replication Configuration for destination bucketsAdded a backup_restore_bucket RDS Option field to RDSSQLServerExpress resource.Added import_from support for netenvsAdded ECR Repository field to IASG for automated permissions.Adding BitBucket support to deployment pipelines.Added IASGPatchManager for automated Windows patchingFixedFixed RDSClusterDefaultInstance monitorability7.8.12 (2021-06-08)AddedImplemented SQLServerExpress RDSAdded redirect_path to IListenerRulesUpdated generated VocabularyAdded 'windows' generic AMI typeAdded VPC Endpoints configurationAdded elb account id map to vocabularyAdded windows_2019 to ami_types vocabularyAdded bool to base obj_hash() method.Fixed- Fixed exception in get_formatted_model_context when handling exceptions.7.8.11 (2021-05-11)FixedFixed missing event_notifications field in RDSClusterDefaultInstanceFixed uninitialized repo_by_account in CodeCommit model object.7.8.10 (2021-05-04)AddedAdded region field to DeploymentPipeline configuration7.8.9 (2021-04-23)AddedAdded support to disable Target Groups on ASGsAdded support to disable services in ECSServices7.8.8 (2021-04-19)FixedAdded resolve_ref to ApplicationEngine model object to fix some paco ref lookups.7.8.7 (2021-04-09)AddedAdded CW_ALARM_DESCRIPTION_HOOK to Paco registryAdded notification_groups field to CW Alarm descriptionsFixedFixed exception for un-initialized value in Parent base class obj_hash method7.8.6 (2021-04-06)AddedAdded codestar_notification_access boolean to sns topics for access policy7.8.5 (2021-04-02)AddedAdded monitoring and notification_events to DeploymentPipelineAdded an ECS utility to the script manager for ASGsChangedModified defaults for Load Balancer and CloudFront SSL security policy.7.8.4 (2021-03-15)AddedAdded ImportFrom functionality.7.8.3 (2021-03-11)AddedAdditional EC2 instance sizes.7.8.2 (2021-02-24)AddedNewcache_policy_idandorigin_request_policy_idfields toICloudFrontDefaultCacheBehaviorschema.7.8.1 (2021-02-05)AddedAddforce_dns_enabledtoIDNSEnablable.7.8.0 (2021-02-04)ChangedThe original deprecatedsnstopicsresource has been removed and only the newsnsresource remains.7.7.6 (2021-02-03)Addexternal_resourcetoICloudWatchLogGroup.7.7.5 (2021-01-29)Addscript_managertoIASGfor ECR Deployments.7.7.4 (2021-01-13)ChangedEC2launch_options.codedeploy_agentwas defaulting to True. It is now False by default.FixedFixed DynamoDB Table resolve_ref.7.7.3 (2021-01-05)AddedECS ASG Capacity Provider has amanaged_instance_protectionfield.7.7.2 (2021-01-05)AddedECS Service has acapacity_providersfield for ECS Capacity Providers.ECS Cluster has acapacity_providersfield that is the default if nolaunch_typeis specified.7.7.1 (2020-12-31)AddedReleasePhases for DeploymentPipeline CodeBuild actions.7.7.0 (2020-12-23)ChangedAdd support for Network Load Balaners. NewIloadBalancerbase class andIApplicationLoadBalancerandINetworkLoadBalancerclasses.
TheLBApplicationclass has been renamed toApplicationLoadBalancer.AddedAlarmDescription metadata now includes a 'ref' field, which is the paco.ref parts to the Alarm resource.Constraint forIS3BucketPolicyandIStatementfor theconditionfield to check for valid AWS Constraint.IBackupPlanhas newcopy_actionsfield.Initial schemas for DynamoDB.FixedAdminIAMUsers forIAccountis now a container with aname.ListenerRules forIListenerfor load balancers is now a container with aname.CloudFrontOrigins forICloudFrontis now a container with aname.CloudFrontFactories forICloudFrontis now a container with aname.7.6.1 (2020-11-12)AddedAddedcodedeploy_agentto field toEC2LaunchOptions.7.6.0 (2020-11-07)FixedCross-account netenv refs are properly detected and don't get munged.add_stack_hookscan be called before oraftertemplate initialization and be registred.IoTPolicy now works with Services.AddedAddadd_paco_suffixfield toS3Bucketresource.Lambda Triggers for CognitoUserPoolPath fields that go to a local path can now use~/to expand to the home directory path.IECSServiceshassetting_groupsfield.IApiGatewayResourcehaschild_resourcesandenable_corsfields.New methodProject.get_all_resources_by_type()which depends upon a Project resource registry which
contains a dict of all application resources grouped by type. Easily query across applications!loader has avalidate_local_pathsto allow loading the model from a CI/CD or other environments
that may not have local paths available.NewIBinaryFileReferenceto load binary files.CloudFront LambdaFunctionAssociation support and Lambda@Edge initial support.Initial Cognito support with resource types forICognitoUserPoolandICognitoIdentityPool.TargetGroup has atarget_typefield.ECSServices has Fargate support.ECSService has atarget_tracking_scaling_policiesfor service scaling.Helpful errors for misconfigured AlarmSets.AddedmonitoringtoECSServicesandECSCluster.Addedecr_repositoriestoIDeploymentPipelineBuildCodeBuildto simplify declaring
ECR Repository permissions.Added aadd_stack_hookstopaco.models.base.Resource.ChangedYAML file loading now accounts for case-sensitive filesystems, but allowing for directory names and
filenames to either be lower-case or capitalized.RenamedIApiGatewayMethodfor ApiGatewayRestApi fromresource_idtoresource_nameto better reflect the name matches the resources of the gatewway.RenamedIAWSCertificateManagertoIACMso that it matches it's Resource Type name.ApiGatewayRestApi doesn't supply a name in it's CloudFormation export7.5.0 (2020-09-17)AddedAddedpaco.models.registryas a place to contain configuration that extends or changes Paco.AddedIIAMUserResourceas an application-level IAMUser resource.MinimalIPinpointApplicationschema for AWS Pinpoint support.AlarmSets and CWLogging are loaded intoproject.monitor. These are used bypaco describefeature.Addedextend_base_schemahook to the loader to allows Services to extend schemas before the loader loads.Container loader can load empty objects (objects with no fields, only a name)Changedpaco.modes.services.list_service_pluginschanged tolist_enabled_services. Returns ony enabed services
in a dict format.IIAMUserProgrammaticAccesschanged toIEnablableand now defaults to True.TheICloudFrontCustomErrorResponsefielderror_caching_min_ttlhas a default of 300.PyLance detected fixes: re-arrangeIRDSschema so it no longer providesIResource.https://github.com/microsoft/pylance-release7.4.0 (2020-07-14)AddedDeploymentPipeline now has anECR.Sourceaction.AddedIEnablablethat is the same asIDeployableexcept it defaults to true.AddedIRDSMysqlAuroraandIRDSPostgresqlAurorafor Aurora support.Added users and groups toresource/ec2.yamlandssh_accessto IASG.ECSSerivce additional fields for deployment_maximum_percent, deployment_minimum_healthy_percent and
health_check_grace_period_seconds.ISecretManagerSecret now has anaccountfield to specify it belongs to a specific account.ChangedIDeploymentPipelineStageActionuses IEnablable so that deployment actions are enabled by default.ISNSTopicuses IEnablable so that topics are enabled by default.7.3.0 (2020-06-22)AddedICodeCommitUser has a permissions field that can be ReadWrite or ReadOnly.IDeploymentPipelineBuildCodeBuild has abuildspecfield.Newpaco.models.gen_vocabularyof vocabularies dynamically generated from AWS API calls. Added vocabulary for
AWS AMI Ids.paco.ref functionnow supports a:synatx to pass extra context to a functionNewpaco.awspackage withpaco.ref functioncalls. First call ispaco.aws.ami_id:latest.amazon-linux-2-ecsECS Cluster with initial EC2 AutoScalingGroup support.Newresource/sns.yamlfiel with SNS global resource to allow SNS Topics and Subscriptions to be provisioned
across any combination of accounts/regions.AWS Config support added inresource/config.yaml.ICloudTrail now has akms_usersfield which is a list of IAM Users granted access to encrypted CloudTrail logs.ChangedISNSTopics has a locations field. This only applies forresource/sns.yamlThe IASGinstance_iam_rolefield is no longer a required field.The home / config_folder is now a pathlib.Path object.7.2.0 (2020-05-09)AddedAddedIASG.launch_options.ssm_agentto indicate if SSM Agent should be installed.AddedIRDSPostgresqlwith RDS for Postgresql support. Added complete list of RDS EngineVerions for
Mysql and Postgresql to vocabulary.ChangedVocabulary for instance_ami_type expanded to include OS major release or other significant attributes.Addedpoll_for_source_changesto IDeploymentPipelineSourceGitHub.Lambda:code:zipfilecan now be a path to a local directory.7.1.0 (2020-04-04)MigrationASG field'supdate_policy_max_batch_sizeandupdate_policy_min_instances_in_serviceare removed.
Instead use the ASG fieldrolling_update_policyand setmax_batch_sizeandmin_instances_in_service.AddedNewmanaged_policiesfor IIAMUserPermissionCustomPolicy to allow easily adding AWS Managed Policies.IIoTAnalyticsPipeline, IIoTTopicRule and IIoTPolicy schemas and implementation to support core IoT
ingestion and analysis.IListener has anssl_policyfor setting the SslPolicy for a SSL Listener.7.0.2 (2020-03-14)FixedRestore cfn-init wget command.7.0.1 (2020-03-14)AddedIDeploymentPipelineDeployS3 has input_artifacts field for Stages/Actions.7.0.0 (2020-03-06)MigrationNotifcationGroups was renamed to SNSTopics.
Migration: git mv resource/NotificationGroups.yaml resource/snstopics.yamlIEventsRule now has an IEventTarget instead of just a paco.ref to the target. This
allows you to specify the input_json for the target.AddedIManagedPolicy has a policy_name field which can be used to specify the name of IAM Policy in AWS.IDeploymentPipelineSourceGitHub to model GitHub.Source actions for CodePipeline.IDeploymentPipeline has a stages field which can be used to create more flexible Stages and Actions
than the pre-baked source/build/deploy fields.ChangedIS3Resource now has an IS3Buckets instead of a dict and references for global buckets
has been cleaned up.FixedAll IVPC schemas with dicts have been replaced by INamed objects so that they can provide a paco_ref.6.4.1 (2020-02-19)AddedNew IVersionControl schema for a IProject configuration.6.4.0 (2020-02-17)AddedIElasticsearchDomain schema.ASG has instance_ami_ignore_changes field to indicate the AMI Id is being updated
externally.paco.ref function can now call any arbitrary Python function.Add enabled_state for IEventRule.Added log_group_names and expire_events_after_days to ILambda to allow it to
manage Log Groups and set a Retention period.ChangedSuperflous ICodeCommitRepositoryGroups was removed and ICodeCommit is the container
now for an ICodeCommitRepositoryGroup.FixedFix errors thrown by loader when loading environments with empty config.6.3.7 (2020-02-05)AddedFull set of fields forgenerate_secret_stringfor Secrets.FixedLambda.add_environment_variable was not passing the parent.6.3.6 (2020-01-29)AddedError message when cfn-init files with !Sub and !Join can't be parsed.6.3.5 (2020-01-23)FixedUbuntu awscli install had extra whitespace which could stop up UserData.6.3.4 (2020-01-16)AddedAdded external_resource field for ICodeCommit.6.3.3 (2020-01-09)AddedThe TextReference class was renamed PacoRefernce and can now be passedschema_constraintwith the
name or Schema that it must be a reference to.Support forusersandgroupsin cfn-init. Invariant to prevent user name duplicating group name.ChangedTemporarily disable chmod 400 check on .credentials to support filesystems that don't have permissions.CodeCommit contains CodeCommitRepositoryGroups and CodeCommitRepostory group objects instead of a two-level dict.
Fixes docs and simplifies loader.FixedLambad.add_environment_variablepasses parent.6.3.2 (2020-01-06)ChangedSchema clean-up, removed IMapping for all schemas that do not actually use it.Removed unused managed_udpates field for IApplication.6.3.1 (2020-01-03)AddedIRoute53HealthCheck has ip_address field.resource/snstopics.yaml is an alias for resource/notificationgroups.yamlraise_invalid_reference method to display helpful message when a ref look-up fails.Fixedcfn-init package sets were only loading for item, now loads all package types.ICloudWatchLogSource log_stream_name is a required field, if it's empty the agent won't launch.6.3.0 (2019-12-03)AddedICloudWatchDashboard for CloudWatch Dashboard resources.Route53 Health Checks have domain_name and enable_sni fields.ChangedInvariant errors in schema checks have non-confusing error message.6.2.1 (2019-11-29)Fixes for the AIM to paco rename.6.2.0 (2019-11-28)ChangedPackage rename:paco.modelsis nowpaco.models, consistent with the tool being
renamed topaco.Top-level directories have been renamed to be consistent with their names in the model:
NetworkEnvironments --> netenv
Resources --> resource
Services --> service
Accounts --> account
MonitorConfig --> monitor
The loader will look forNetworkEnvironmentsand if it exists use the legacy names.AddedAdded support for AWS Backup Vault. There can now be global backup_vaults field in NetworkEnvironment YAML files.
These can be overrode in EnvironmentDefault and EnvironmentRegion configuration sections.Added support for block_device_mappings for IASG.6.1.0 (2019-11-06)AddedApplications can be provisioned in the same environment more than once with a new
"app{suffix}" syntax for an environments application keys.INotificationGroups has a regions field, if it is the default of ['ALL'] it will apply to
all of a project's active regions. Otherwise is will just provision in the selected region(s).ICloudFormationInit for modelling AWS::CloudFormation::Init, which can be applied to
the IASG.cfn_init field.ICloudWatchLogAlarm schema. ICloudWatchAlarm now has "type: Alarm" and if it is "type: LogAlarm"
an ICloudWatchLogAlarm will be created which can be used to connect an alarm to a MetricFilter
of a LogGroup.IDBParameterGrouups resource.IElastiCache hasdescriptionandcache_clustersfields, while IElastiCacheRedis hassnapshot_retention_limit_daysandsnapshot_windowfields.IRDS has newlicense_model,cloudwatch_logs_exportanddeletion_protectionfields.global_role_namefield for IAM Role can be set to True and the RoleName
will not be hashed. Can only be used for global Roles, otherwise if these
Roles overlap per-environment, things will break!monitoring.health_checkswhich can contain HealthCheck Resources.
IRoute53HealthCheck resource for Route53 health checks.region_nameproperty can be overrode if aoverrode_region_nameattribute is set.Added a CodeBuild IAM Permission for IAM UsersAddedresolve_refmethod to DeploymentPipelineConfigurationAdded the EIP Application Resource and a support 'eip' field to the ASG resource for associating an EIP with a single instance ASG.Added AWS Cli install commands to vocabulary.Addeddnsto EIP Application ResourceAddedcftemplate_iam_user_delegates_2019_10_02legacy flag to make user delegate role stack names consistent with others.Addedroute53_hosted_zone_2019_10_12legacy flag for Route53 CFTemplate refactor.Addedroute53_record_set_2019_10_16legacy flag for the Route53 RecordSet refactor.Addedavailability_zonefor locking in an ASG to a single Availability Zone.Addedparameter_groupto IElastiCache Application ResourceAddedvpc_associationsto IPrivateHosted.Addedvpc_configto the ILambda Application ResourcesAddedsecrets_managerto IIEnvironmentDefault.Addedttlto IDNSAdded caching to instance AMI ID function.ref lookups.Added the EBS Application Resources.
Addedebs_volume_mountsto IASG to mount volumes to single instance groups.Addedlaunch_optionsto IASG as an IEC2LaunchOptions object. The initial option is update_packages which will update the linux distributions packages on launch.Added resolve_ref() to Resource in base.py as a catch all.ChangedISecurityGroupRulesource_security_groupwas moved to IIngressRule and IEgressRule (finally!)
has adestination_security_groupfield.load_resourceswas removed and you can now simply apply_attributes to
an Application and it will recurse through app.groups..resources.
without any external fiddling.Moved deepdiff CLI functions intoaimproject.IApplication is now IMonitorable. Alarms at the Application level must
specify their Namespace and Dimensions.Changed RDSprimary_domain_nameandprimary_hosted_zoneto an IDNS objectFixedAlarm overrides are now cast to the schema of the field. Fixes "threshold: 10" loading as in int()
when the schema expects a float().6.0.0 (2019-09-27)AddedICloudWatchAlarms haveenable_ok_actionsandenable_insufficient_data_actionsbooleans
that will send to the notification groups when the alarm enters the OK or INSUFFICIENT_DATA states.references.get_model_obj_refwill resolve an paco.ref to a model object
and won't attempt to do Stack output lookups.Service plug-ins are loaded according to aninitilization_orderinteger
that each plug-in can supply. If no integer is supplied, loading for unordered
plug-ins count up from 1000.Minimal API Gateway models for Methods, Resources, Models and Stages.S3Bucket NotificationConfiguration for Lambdas.S3Bucket hasget_bucket_name()to return the full computed bucket name.IGlobalResources for project['resource'] to contain config from the ./Resources/ directory.
Resources such as S3 and EC2 now implement INamed and are loaded into project['resource'].ISNSTopic hascross_account_accesswhich grantssns:Publishto all accounts in the AIM Project.IAccountContainer and IRegionContainer are lightweight containers for account and region information.
They can be used by Services that want to set-up Resources in a multi-account, multi-region manner.ChangedCloudTrail defines CloudWatchLogGroup as a sub-object rather than an paco.ref.Alarms haveget_alarm_actions_paco_refsrenamed fromget_alarm_actionsas alarms can only provide
paco.refs and need to get the ARNs from the stacks.NotificationGroups are now Resources. Now they have regular working paco.ref's.5.0.0 (2019-08-26)AddedNew fieldpaco.models.reference.FileReferencewhich resolves the path and replaces
the original value with the value of the file indicated by the path.
IApiGatewayRestApi.body_file_location uses this new field.ApiGatewayRestApi and CloudWatchAlarm have acfn_export_dictproperty that
returns a new dict that can be used to created Troposphere resources.Added external_resource support to the ACMAdded ReadOnly support to the Administrator IAMUserPermissionChangedMulti-Dimension Alarms now need to specify anpaco.refas the Value.Added IAMUser schemas and loading for IAM users.Added a CommaList() schema type for loading comma separated lists into schema.List()Moved aim reference generation into the Model. Model objects now have .paco_ref and
.paco_ref_parts properties which contain their paco.ref reference.Renamed project['ne'] to project['netenv']Modified NatGateway segments to aim referencesFixedInvariants were not being check for resources. Invariants need to be checked by the
loader if they are not contained in azope.schema.Objectfield, which will run the
check behind the scenes.4.0.0 (2019-08-21)AddedIVPCPeering and IVPCPeeringRoute have been added to the model for VPC Peering support.Added a CloudTrail schema configured inResources/CloudTrail.yaml.IS3BucketPolicy now hasprincipalandconditionfields.principalcan be either a Key-Value dictionary, where the key is either 'AWS', 'Service', etc.
and the value can be either a String or a List. It is an alternate to theawsfield, which will
remain for setting simpler AWS-only principals.
Theconditionfield is a Key-Value dictionary of Key-Value filters.Alarm now has 'get_alarm_actions' and 'get_alarm_description' to help construct alarms.CloudTrail has a 'get_accounts' which will resolve the CloudTrail.accounts field to a list
of Account objects in the model.IAlarm hasdescriptionandrunbook_urlfields.CodePipeBuildDeploy.resolve_ref() function covers wider scope of ref lookupsAdded VPCPeering to the model.Added IElastiCache and IElastiCacheRedis to the model.ChangedMonitorConfig/LogSets.yamlhas been renamed toMonitorConfig/Logging.yaml. CloudWatch
logging is under the top levelcw_loggingkey. The schema has been completely reworked
so that LogGroups and LogSets are properly modelled.IAccount.region, IEC2KeyPair.region and ICredentials.aws_default_region no longer haveus-west-2as a default. The region needs to be explicity set.FixedIAlarm.classification is now a required field.3.1.0 (2019-08-08)Addedaim-project-version.txt file in the root directory can now contain the AIM Project YAML
version. IProject now has an paco_project_version field to store this value.ICloudWatchAlarm gets a namespace field. Can be used to override the default
Resource namespace, for example, use 'CWAgent' for the CloudWatch agent metrics.IResource now has a resource_fullname field. The fullname is the name needed to
specify for a metric in a CloudWatch Alarm.ICloudWatchAlarm now has a dimensions field, which is a List of Dimension objects.ITargetGroup now inherits from IResource. It loads resource_name from outputs.3.0.0 (2019-08-06)AddedNewMonitorConfig/NotificationGroups.yamlthat contains subscription groups for notifications.sdb_cache field for Lambda.Lambda can have alarms.ISNSTopic and ISNSTopicSubscription to model SNS.ChangedAll references have been renamed to start withpaco.reffor consistency.AlarmSets, AlarmSet and Alarm all now implement INamed and
are locatable in the modelService plugins can load their outputs2.0.0 (2019-07-23)AddedSchema for Notifications for subscribing to AlarmsAdded S3Resource for Resources/S3.yml configurationAdded Lambda resolve_ref supportChangedServices are loaded as entry_point plugins namedpaco.servicesRefactored the models applications, resources, and services.Renamed IRoute53 to IRoute53Resource.FixedCloudWatchAlarms now validate a classification field value of
'performance', 'health' or 'security' is supplied.1.1.0 (2019-07-06)AddedAdded function.ref to be able to look-up latest AMI IDsAdded more constraints to the schemas.Added default to IS3Bucket.policyAdded Route53 to schema and modelAdded redirect to Listner rules in the ALBChangedDescription attribute for Fields is now used to describe constraints.Ported CodeCommit to schema and modelRefactored S3 to use Application StackGroupCPBD artifacts s3 bucket now uses S3 Resource in NetEnv yaml insteadConverted the ALB's listener and listener rules to dicts from listsRemovedRemoved unused yaml config from pacodemo under fixtures.1.0.1 (2019-06-19)Improvements to Python packaging metadata.1.0.0 (2019-06-19)First open source release