Skip to content

Commit 4c3e2f6

Browse files
authored
New: [AEA-0000] - extend cdk-construct library (#478)
## Summary - Routine Change - ✨ New Feature ### Details - add some helper functions to suppress nag and cfn guard warnings - add python lambda construct - remove checking for scanner findings
1 parent 83a10bf commit 4c3e2f6

20 files changed

+1138
-291
lines changed

.github/scripts/check_ecr_image_scan_results.sh

Lines changed: 0 additions & 138 deletions
This file was deleted.

.github/workflows/ci.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,12 @@ jobs:
4444
TAG_FORMAT=$(yq '.TAG_FORMAT' .github/config/settings.yml)
4545
echo "TAG_FORMAT=$TAG_FORMAT" >> "$GITHUB_OUTPUT"
4646
quality_checks:
47-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks.yml@27a44fb54f4023136d2c14058e3256e73af9901e
47+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks.yml@e31e25273fb87450be4ef763ddbed4f531c45f8e
4848
needs: [get_asdf_version, get_commit_id]
4949
with:
5050
asdfVersion: ${{ needs.get_asdf_version.outputs.asdf_version }}
51+
run_docker_scan: true
52+
docker_images: "eps-cdk-utils"
5153
secrets:
5254
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
5355

.github/workflows/docker_image_upload.yml

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -81,11 +81,3 @@ jobs:
8181
run: |
8282
docker tag "cdk-utils-build:${VERSION_NUMBER}" "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/cdk-utils-build-repo:latest"
8383
docker push "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/cdk-utils-build-repo:latest"
84-
85-
- name: Check cdk-utils-build scan results
86-
env:
87-
REPOSITORY_NAME: cdk-utils-build-repo
88-
IMAGE_TAG: ${{ inputs.DOCKER_IMAGE_TAG }}
89-
working-directory: .github/scripts
90-
run: |
91-
./check_ecr_image_scan_results.sh

.github/workflows/pull_request.yml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,10 +34,13 @@ jobs:
3434
pr_title_format_check:
3535
uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@27a44fb54f4023136d2c14058e3256e73af9901e
3636
quality_checks:
37-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks.yml@27a44fb54f4023136d2c14058e3256e73af9901e
37+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks.yml@e31e25273fb87450be4ef763ddbed4f531c45f8e
3838
needs: [get_asdf_version, get_commit_id]
3939
with:
4040
asdfVersion: ${{ needs.get_asdf_version.outputs.asdf_version }}
41+
run_docker_scan: true
42+
docker_images: "eps-cdk-utils"
43+
4144
secrets:
4245
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
4346

.github/workflows/release.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,12 @@ jobs:
4545
TAG_FORMAT=$(yq '.TAG_FORMAT' .github/config/settings.yml)
4646
echo "TAG_FORMAT=$TAG_FORMAT" >> "$GITHUB_OUTPUT"
4747
quality_checks:
48-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks.yml@27a44fb54f4023136d2c14058e3256e73af9901e
48+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks.yml@e31e25273fb87450be4ef763ddbed4f531c45f8e
4949
needs: [get_asdf_version, get_commit_id]
5050
with:
5151
asdfVersion: ${{ needs.get_asdf_version.outputs.asdf_version }}
52+
run_docker_scan: true
53+
docker_images: "eps-cdk-utils"
5254
secrets:
5355
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
5456

.trivyignore.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
vulnerabilities:
2+
- id: CVE-2025-64756
3+
statement: downstream dependency for glob - waiting for new npm release
4+
expired_at: 2026-06-01
5+
- id: CVE-2026-23745
6+
statement: downstream dependency for tar - waiting for new npm release
7+
expired_at: 2026-06-01
8+
- id: CVE-2026-23950
9+
statement: downstream dependency for tar - waiting for new npm release
10+
expired_at: 2026-06-01
11+
- id: CVE-2026-24842
12+
statement: downstream dependency for tar - waiting for new npm release
13+
expired_at: 2026-06-01
14+
- id: CVE-2026-24049
15+
statement: downstream dependency for wheel - waiting for new python release
16+
expired_at: 2026-06-01
17+
- id: CVE-2025-47907
18+
statement: downstream dependency for asdf/go - waiting for new asdf release
19+
expired_at: 2026-06-01
20+
- id: CVE-2025-58183
21+
statement: downstream dependency for asdf/go - waiting for new asdf release
22+
expired_at: 2026-06-01
23+
- id: CVE-2025-61729
24+
statement: downstream dependency for asdf/go - waiting for new asdf release
25+
expired_at: 2026-06-01

Makefile

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,7 @@ lint-node:
2525
lint-githubactions:
2626
actionlint
2727

28-
lint-githubaction-scripts:
29-
shellcheck .github/scripts/*.sh
30-
31-
lint: lint-node lint-githubactions lint-githubaction-scripts
28+
lint: lint-node lint-githubactions
3229

3330
clean:
3431
rm -rf packages/cdkConstructs/lib
@@ -69,3 +66,6 @@ package: build
6966
build:
7067
npm run build --workspace packages/cdkConstructs
7168
npm run build --workspace packages/deploymentUtils
69+
70+
docker-build:
71+
docker build -t eps-cdk-utils . -f docker/Dockerfile

packages/cdkConstructs/src/apps/createApp.ts

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,40 +5,62 @@ import {
55
StackProps
66
} from "aws-cdk-lib"
77
import {AwsSolutionsChecks} from "cdk-nag"
8-
import {getConfigFromEnvVar, getBooleanConfigFromEnvVar, calculateVersionedStackName} from "../config"
8+
import {getConfigFromEnvVar, getBooleanConfigFromEnvVar} from "../config"
99

1010
export interface StandardStackProps extends StackProps {
11-
readonly stackName: string
11+
/** Semantic version of the deployment (from `versionNumber`). */
1212
readonly version: string
13+
/** Git commit identifier baked into the stack. */
1314
readonly commitId: string
15+
/** Whether the stack originates from a pull-request environment. */
1416
readonly isPullRequest: boolean
17+
/** Logical environment identifier (for example `dev`, `prod`). */
1518
readonly environment: string
19+
/** CDK environment configuration used when synthesizing the stack. */
20+
readonly env: {
21+
/** AWS region targeted by the stack. */
22+
readonly region: string
23+
}
1624
}
1725

1826
export interface CreateAppParams {
1927
readonly productName: string
2028
readonly appName: string
2129
readonly repoName: string
2230
readonly driftDetectionGroup: string
23-
readonly isStateless?: boolean
2431
readonly region?: string
2532
readonly projectType?: string
2633
readonly publicFacing?: string
2734
readonly serviceCategory?: string
2835
}
2936

37+
/**
38+
* Initialize a CDK `App` pre-loaded with NHS EPS tags and mandatory configuration.
39+
*
40+
* Reads stack metadata from environment variables, and returns
41+
* both the created `App` instance and the resolved stack props (including version info).
42+
*
43+
* @param params - High-level app metadata and optional deployment modifiers.
44+
* @param params.productName - Product tag value for the stack.
45+
* @param params.appName - Identifier used for `cdkApp` tagging.
46+
* @param params.repoName - Repository name stored on the stack tags.
47+
* @param params.driftDetectionGroup - Baseline drift detection tag (suffixes `-pull-request` when `isPullRequest`).
48+
* @param params.region - AWS region assigned to the stack environment (default `eu-west-2`).
49+
* @param params.projectType - Tag describing the project classification (default `Production`).
50+
* @param params.publicFacing - Public-facing classification tag (default `Y`).
51+
* @param params.serviceCategory - Service category tag (default `Platinum`).
52+
* @returns The constructed CDK `App` and the resolved stack props for downstream stacks.
53+
*/
3054
export function createApp({
3155
productName,
3256
appName,
3357
repoName,
3458
driftDetectionGroup,
35-
isStateless = true,
3659
region = "eu-west-2",
3760
projectType = "Production",
3861
publicFacing = "Y",
3962
serviceCategory = "Platinum"
4063
}: CreateAppParams): { app: App, props: StandardStackProps } {
41-
let stackName = getConfigFromEnvVar("stackName")
4264
const versionNumber = getConfigFromEnvVar("versionNumber")
4365
const commitId = getConfigFromEnvVar("commitId")
4466
const isPullRequest = getBooleanConfigFromEnvVar("isPullRequest")
@@ -68,22 +90,16 @@ export function createApp({
6890
Tags.of(app).add("DeploymentTool", "CDK")
6991
Tags.of(app).add("version", versionNumber)
7092
Tags.of(app).add("commit", commitId)
71-
Tags.of(app).add("stackName", stackName)
7293
Tags.of(app).add("cdkApp", appName)
7394
Tags.of(app).add("repo", repoName)
7495
Tags.of(app).add("cfnDriftDetectionGroup", cfnDriftDetectionGroup)
7596

76-
if (isStateless && !isPullRequest) {
77-
stackName = calculateVersionedStackName(stackName, versionNumber)
78-
}
79-
8097
return {
8198
app,
8299
props: {
83100
env: {
84101
region
85102
},
86-
stackName,
87103
version: versionNumber,
88104
commitId,
89105
isPullRequest,

packages/cdkConstructs/src/config/index.ts

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,5 @@ export async function getTrustStoreVersion(trustStoreFile: string, region: strin
3535
export function calculateVersionedStackName(baseStackName: string, version: string): string {
3636
return `${baseStackName}-${version.replaceAll(".", "-")}`
3737
}
38+
39+
export {LAMBDA_INSIGHTS_LAYER_ARNS} from "./lambdaInsights"
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
// see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Lambda-Insights-extension-versions.html
2+
// for latest ARNs
3+
export const LAMBDA_INSIGHTS_LAYER_ARNS = {
4+
x64: "arn:aws:lambda:eu-west-2:580247275435:layer:LambdaInsightsExtension:64",
5+
arm64: "arn:aws:lambda:eu-west-2:580247275435:layer:LambdaInsightsExtension-Arm64:31"
6+
} as const

0 commit comments

Comments
 (0)