mirror of
https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git
synced 2026-10-07 16:08:55 +00:00
Adam Moussa
63dcdde83e
Stand up AppWebAcl in a thin prod stack and widen seahaven-site HCP roles to read the SSM ARN so CloudFront can associate the ACL in-account.
25 lines
1,010 B
TypeScript
25 lines
1,010 B
TypeScript
import * as cdk from "aws-cdk-lib";
|
|
import { Construct } from "constructs";
|
|
import { AppWebAcl } from "./web-acl";
|
|
|
|
/**
|
|
* Thin per-account stack that owns the shared CloudFront WAFv2 WebACL (M-17)
|
|
* and publishes its ARN to SSM `/seahaven/waf/app-web-acl-arn`.
|
|
*
|
|
* Mgmt already has this ACL inside `AccountBaselineStack`. Workload accounts
|
|
* (starting with seahaven-prod / PLAT-92) get a dedicated stack so we do not
|
|
* pull the full mgmt baseline (trail, budgets, flow logs, …) into prod just
|
|
* to share a CloudFront WAF. App stacks associate by reading the SSM param
|
|
* in-account — WAFv2 CloudFront associations are same-account only.
|
|
*/
|
|
export class AppWebAclStack extends cdk.Stack {
|
|
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
|
|
super(scope, id, props);
|
|
|
|
new AppWebAcl(this, "AppWebAcl");
|
|
|
|
cdk.Tags.of(this).add("Project", "account-baseline");
|
|
cdk.Tags.of(this).add("Owner", "adam@seahavenind.com");
|
|
cdk.Tags.of(this).add("ManagedBy", "cdk");
|
|
}
|
|
}
|