mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-09-30 15:03:16 +00:00
92fd886076
PR#1 of the AWS migration. CDK TypeScript app under /infra: stacks open-swe-iam (four per-env GitHub-OIDC deploy roles) + open-swe-dev/-prod (per-env EC2 instance role + AMI cache). aws-cdk-lib pinned exact 2.260.0; kebab naming Aspect + 15 tests. IAM is synth-only (NOT deployed). Cleared the Phase-1 security gates: - T4 GPT-4.1 IAM cross-review (StringEquals trust; cdk-hnb659fds-* wildcard kept as org convention; AWS-RunShellScript timeboxed to T19). - T5 /sh-security-review: deploy roles split PER-ENV with env-scoped OIDC trust (dev=branch ref+tag dev, prod=environment:prod+tag prod) so a dev token cannot reach prod; re-verified block:false.
35 lines
1 KiB
JavaScript
35 lines
1 KiB
JavaScript
#!/usr/bin/env node
|
|
import "source-map-support/register";
|
|
import * as cdk from "aws-cdk-lib";
|
|
import { ACCOUNT, REGION } from "../lib/config";
|
|
import { OpenSweIamStack } from "../lib/open-swe-iam-stack";
|
|
import { OpenSweStack } from "../lib/open-swe-stack";
|
|
import { KebabNamingAspect } from "../lib/aspects/kebab-naming-aspect";
|
|
|
|
const app = new cdk.App();
|
|
const env = { account: ACCOUNT, region: REGION };
|
|
|
|
// Account-level shared OIDC deploy roles (singletons). Deployed FIRST.
|
|
new OpenSweIamStack(app, "OpenSweIamStack", {
|
|
stackName: "open-swe-iam",
|
|
env,
|
|
});
|
|
|
|
// The two env stacks — explicit kebab-case stackName (never let CDK default to
|
|
// PascalCase), env-parameterised so resources are `open-swe-<env>-*`.
|
|
new OpenSweStack(app, "OpenSweDevStack", {
|
|
stackName: "open-swe-dev",
|
|
env,
|
|
envName: "dev",
|
|
});
|
|
|
|
new OpenSweStack(app, "OpenSweProdStack", {
|
|
stackName: "open-swe-prod",
|
|
env,
|
|
envName: "prod",
|
|
});
|
|
|
|
// Fail synth on any non-kebab-case explicit resource/stack name.
|
|
cdk.Aspects.of(app).add(new KebabNamingAspect());
|
|
|
|
app.synth();
|