Skip to content

Commit 1ddcc34

Browse files
anthony-nhsanthony-nhs
committed
start refactor
1 parent 1453734 commit 1ddcc34

7 files changed

Lines changed: 325 additions & 43 deletions

File tree

‎.devcontainer/devcontainer.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,9 @@
3232
"github.vscode-pull-request-github",
3333
"streetsidesoftware.code-spell-checker",
3434
"timonwong.shellcheck",
35-
"github.vscode-github-actions"
35+
"github.vscode-github-actions",
36+
"dbaeumer.vscode-eslint",
37+
"vitest.explorer"
3638
],
3739
"settings": {
3840
"cSpell.words": [

‎.vscode/eps-cdk-utils.code-workspace‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,10 @@
7979
".vscode"
8080
],
8181
"eslint.useFlatConfig": true,
82-
"eslint.format.enable": true
82+
"eslint.format.enable": true,
83+
"[typescript]": {
84+
"editor.defaultFormatter": "dbaeumer.vscode-eslint"
85+
}
8386
},
8487
"extensions": {
8588
"recommendations": [

‎packages/cdkConstructs/src/constructs/PythonLambdaFunction.ts‎

Lines changed: 55 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ import {
1818
import {join} from "node:path"
1919
import {createSharedLambdaResources} from "./lambdaSharedResources"
2020
import {addSuppressions} from "../utils/helpers"
21+
import {Key} from "aws-cdk-lib/aws-kms"
22+
import {CfnDeliveryStream} from "aws-cdk-lib/aws-kinesisfirehose"
2123

2224
export interface PythonLambdaFunctionProps {
2325
/**
@@ -42,7 +44,7 @@ export interface PythonLambdaFunctionProps {
4244
/**
4345
* A map of environment variables to set for the lambda function.
4446
*/
45-
readonly environmentVariables?: {[key: string]: string}
47+
readonly environmentVariables?: { [key: string]: string }
4648
/**
4749
* Optional additional IAM policies to attach to role the lambda executes as.
4850
*/
@@ -80,16 +82,45 @@ export interface PythonLambdaFunctionProps {
8082
* @default Architecture.X86_64
8183
*/
8284
readonly architecture?: Architecture
83-
/**
84-
* Any files to exclude from the Lambda asset bundle.
85-
* Defaults to these files
86-
* "tests",
87-
* "pytest.ini",
88-
* ".vscode",
89-
* "__pycache__",
90-
* "*.pyc"
91-
*/
85+
/**
86+
* Any files to exclude from the Lambda asset bundle.
87+
* Defaults to these files
88+
* "tests",
89+
* "pytest.ini",
90+
* ".vscode",
91+
* "__pycache__",
92+
* "*.pyc"
93+
*/
9294
readonly excludeFromAsset?: Array<string>
95+
/**
96+
* Optional KMS key for encrypting CloudWatch Logs.
97+
* If not provided, the value is imported from account resources export.
98+
*/
99+
readonly cloudWatchLogsKmsKey?: Key
100+
/**
101+
* Optional IAM policy for allowing CloudWatch to use the KMS key for encrypting logs.
102+
* If not provided, the value is imported from account resources export.
103+
*/
104+
readonly cloudwatchEncryptionKMSPolicy?: ManagedPolicy
105+
/**
106+
* Optional Kinesis stream for forwarding logs to Splunk.
107+
* If not provided, the value is imported from account resources export.
108+
*/
109+
readonly splunkDeliveryStream?: CfnDeliveryStream
110+
/**
111+
* Optional IAM role for the subscription filter that forwards logs to Splunk.
112+
* If not provided, the value is imported from account resources export.
113+
*/
114+
readonly splunkSubscriptionFilterRole?: Role
115+
/**
116+
* Optional IAM policy for allowing lambdas to use Lambda Insights log groups and streams.
117+
* If not provided, the value is imported from account resources export.
118+
*/
119+
readonly lambdaInsightsLogGroupPolicy?: ManagedPolicy
120+
/**
121+
* Whether to create a subscription filter on the Lambda log group to forward logs to Splunk. Defaults to true.
122+
*/
123+
readonly addSplunkSubscriptionFilter?: boolean
93124

94125
}
95126

@@ -185,14 +216,26 @@ export class PythonLambdaFunction extends Construct {
185216
".vscode",
186217
"__pycache__",
187218
"*.pyc"
188-
]
219+
],
220+
cloudWatchLogsKmsKey,
221+
cloudwatchEncryptionKMSPolicy,
222+
splunkDeliveryStream,
223+
splunkSubscriptionFilterRole,
224+
lambdaInsightsLogGroupPolicy,
225+
addSplunkSubscriptionFilter
189226
} = props
190227

191228
const {logGroup, role, insightsLayer} = createSharedLambdaResources(this, {
192229
functionName,
193230
logRetentionInDays,
194231
additionalPolicies,
195-
architecture
232+
architecture,
233+
cloudWatchLogsKmsKey,
234+
cloudwatchEncryptionKMSPolicy,
235+
splunkDeliveryStream,
236+
splunkSubscriptionFilterRole,
237+
lambdaInsightsLogGroupPolicy,
238+
addSplunkSubscriptionFilter
196239
})
197240

198241
const layersToAdd = [insightsLayer]

‎packages/cdkConstructs/src/constructs/TypescriptLambdaFunction.ts‎

Lines changed: 45 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ import {Construct} from "constructs"
1616
import {join} from "node:path"
1717
import {createSharedLambdaResources} from "./lambdaSharedResources"
1818
import {addSuppressions} from "../utils/helpers"
19+
import {Key} from "aws-cdk-lib/aws-kms"
20+
import {CfnDeliveryStream} from "aws-cdk-lib/aws-kinesisfirehose"
1921

2022
export interface TypescriptLambdaFunctionProps {
2123
/**
@@ -84,6 +86,35 @@ export interface TypescriptLambdaFunctionProps {
8486
* @default Architecture.X86_64
8587
*/
8688
readonly architecture?: Architecture
89+
/**
90+
* Optional KMS key for encrypting CloudWatch Logs.
91+
* If not provided, the value is imported from account resources export.
92+
*/
93+
readonly cloudWatchLogsKmsKey?: Key
94+
/**
95+
* Optional IAM policy for allowing CloudWatch to use the KMS key for encrypting logs.
96+
* If not provided, the value is imported from account resources export.
97+
*/
98+
readonly cloudwatchEncryptionKMSPolicy?: ManagedPolicy
99+
/**
100+
* Optional Kinesis stream for forwarding logs to Splunk.
101+
* If not provided, the value is imported from account resources export.
102+
*/
103+
readonly splunkDeliveryStream?: CfnDeliveryStream
104+
/**
105+
* Optional IAM role for the subscription filter that forwards logs to Splunk.
106+
* If not provided, the value is imported from account resources export.
107+
*/
108+
readonly splunkSubscriptionFilterRole?: Role
109+
/**
110+
* Optional IAM policy for allowing lambdas to use Lambda Insights log groups and streams.
111+
* If not provided, the value is imported from account resources export.
112+
*/
113+
readonly lambdaInsightsLogGroupPolicy?: ManagedPolicy
114+
/**
115+
* Whether to create a subscription filter on the Lambda log group to forward logs to Splunk. Defaults to true.
116+
*/
117+
readonly addSplunkSubscriptionFilter?: boolean
87118
}
88119

89120
const getDefaultLambdaOptions = (
@@ -202,14 +233,26 @@ export class TypescriptLambdaFunction extends Construct {
202233
projectBaseDir,
203234
timeoutInSeconds = 50,
204235
runtime = Runtime.NODEJS_24_X,
205-
architecture = Architecture.X86_64
236+
architecture = Architecture.X86_64,
237+
cloudWatchLogsKmsKey,
238+
cloudwatchEncryptionKMSPolicy,
239+
splunkDeliveryStream,
240+
splunkSubscriptionFilterRole,
241+
lambdaInsightsLogGroupPolicy,
242+
addSplunkSubscriptionFilter
206243
} = props
207244

208245
const {logGroup, role, insightsLayer} = createSharedLambdaResources(this, {
209246
functionName,
210247
logRetentionInDays,
211248
additionalPolicies,
212-
architecture
249+
architecture,
250+
cloudWatchLogsKmsKey,
251+
cloudwatchEncryptionKMSPolicy,
252+
splunkDeliveryStream,
253+
splunkSubscriptionFilterRole,
254+
lambdaInsightsLogGroupPolicy,
255+
addSplunkSubscriptionFilter
213256
})
214257

215258
const lambdaFunction = new NodejsFunction(this, functionName, {

‎packages/cdkConstructs/src/constructs/lambdaSharedResources.ts‎

Lines changed: 31 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ import {Construct} from "constructs"
22
import {Fn, RemovalPolicy} from "aws-cdk-lib"
33
import {Architecture, ILayerVersion, LayerVersion} from "aws-cdk-lib/aws-lambda"
44
import {Key} from "aws-cdk-lib/aws-kms"
5-
import {Stream} from "aws-cdk-lib/aws-kinesis"
65
import {CfnLogGroup, CfnSubscriptionFilter, LogGroup} from "aws-cdk-lib/aws-logs"
76
import {
87
IManagedPolicy,
@@ -14,12 +13,19 @@ import {
1413
import {NagSuppressions} from "cdk-nag"
1514
import {LAMBDA_INSIGHTS_LAYER_ARNS} from "../config"
1615
import {addSuppressions} from "../utils/helpers"
16+
import {CfnDeliveryStream} from "aws-cdk-lib/aws-kinesisfirehose"
1717

1818
export interface SharedLambdaResourceProps {
1919
readonly functionName: string
2020
readonly logRetentionInDays: number
2121
readonly additionalPolicies: Array<IManagedPolicy>
2222
readonly architecture: Architecture
23+
readonly cloudWatchLogsKmsKey?: Key
24+
readonly cloudwatchEncryptionKMSPolicy?: ManagedPolicy
25+
readonly splunkDeliveryStream?: CfnDeliveryStream
26+
readonly splunkSubscriptionFilterRole?: Role
27+
readonly lambdaInsightsLogGroupPolicy?: ManagedPolicy
28+
readonly addSplunkSubscriptionFilter?: boolean
2329
}
2430

2531
export interface SharedLambdaResources {
@@ -30,28 +36,25 @@ export interface SharedLambdaResources {
3036

3137
export const createSharedLambdaResources = (
3238
scope: Construct,
33-
{
39+
props: SharedLambdaResourceProps
40+
): SharedLambdaResources => {
41+
const {
3442
functionName,
3543
logRetentionInDays,
3644
additionalPolicies,
37-
architecture
38-
}: SharedLambdaResourceProps
39-
): SharedLambdaResources => {
40-
const cloudWatchLogsKmsKey = Key.fromKeyArn(
41-
scope, "cloudWatchLogsKmsKey", Fn.importValue("account-resources:CloudwatchLogsKmsKeyArn"))
42-
43-
const cloudwatchEncryptionKMSPolicy = ManagedPolicy.fromManagedPolicyArn(
44-
scope, "cloudwatchEncryptionKMSPolicyArn", Fn.importValue("account-resources:CloudwatchEncryptionKMSPolicyArn"))
45-
46-
const splunkDeliveryStream = Stream.fromStreamArn(
47-
scope, "SplunkDeliveryStream", Fn.importValue("lambda-resources:SplunkDeliveryStream"))
48-
49-
const splunkSubscriptionFilterRole = Role.fromRoleArn(
50-
scope, "splunkSubscriptionFilterRole", Fn.importValue("lambda-resources:SplunkSubscriptionFilterRole"))
51-
52-
const lambdaInsightsLogGroupPolicy = ManagedPolicy.fromManagedPolicyArn(
53-
scope, "lambdaInsightsLogGroupPolicy", Fn.importValue("lambda-resources:LambdaInsightsLogGroupPolicy"))
54-
45+
architecture,
46+
cloudWatchLogsKmsKey = Key.fromKeyArn(
47+
scope, "cloudWatchLogsKmsKey", Fn.importValue("account-resources:CloudwatchLogsKmsKeyArn")),
48+
cloudwatchEncryptionKMSPolicy = ManagedPolicy.fromManagedPolicyArn(
49+
scope, "cloudwatchEncryptionKMSPolicyArn", Fn.importValue("account-resources:CloudwatchEncryptionKMSPolicyArn")),
50+
splunkDeliveryStream = CfnDeliveryStream.fromDeliveryStreamArn(
51+
scope, "SplunkDeliveryStream", Fn.importValue("lambda-resources:SplunkDeliveryStream")),
52+
splunkSubscriptionFilterRole = Role.fromRoleArn(
53+
scope, "splunkSubscriptionFilterRole", Fn.importValue("lambda-resources:SplunkSubscriptionFilterRole")),
54+
lambdaInsightsLogGroupPolicy = ManagedPolicy.fromManagedPolicyArn(
55+
scope, "lambdaInsightsLogGroupPolicy", Fn.importValue("lambda-resources:LambdaInsightsLogGroupPolicy")),
56+
addSplunkSubscriptionFilter = true
57+
} = props
5558
const insightsLambdaLayerArn = architecture === Architecture.ARM_64
5659
? LAMBDA_INSIGHTS_LAYER_ARNS.arm64
5760
: LAMBDA_INSIGHTS_LAYER_ARNS.x64
@@ -68,12 +71,14 @@ export const createSharedLambdaResources = (
6871
const cfnlogGroup = logGroup.node.defaultChild as CfnLogGroup
6972
addSuppressions([cfnlogGroup], ["CW_LOGGROUP_RETENTION_PERIOD_CHECK"])
7073

71-
new CfnSubscriptionFilter(scope, "LambdaLogsSplunkSubscriptionFilter", {
72-
destinationArn: splunkDeliveryStream.streamArn,
73-
filterPattern: "",
74-
logGroupName: logGroup.logGroupName,
75-
roleArn: splunkSubscriptionFilterRole.roleArn
76-
})
74+
if (addSplunkSubscriptionFilter) {
75+
new CfnSubscriptionFilter(scope, "LambdaLogsSplunkSubscriptionFilter", {
76+
destinationArn: splunkDeliveryStream.deliveryStreamRef.deliveryStreamArn,
77+
filterPattern: "",
78+
logGroupName: logGroup.logGroupName,
79+
roleArn: splunkSubscriptionFilterRole.roleArn
80+
})
81+
}
7782

7883
const putLogsManagedPolicy = new ManagedPolicy(scope, "LambdaPutLogsManagedPolicy", {
7984
description: `write to ${functionName} logs`,

‎packages/cdkConstructs/tests/constructs/pythonLambdaFunctionConstruct.test.ts‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -374,3 +374,29 @@ describe("pythonFunctionConstruct works correctly with different architecture",
374374
})
375375
})
376376
})
377+
378+
describe("pythonFunctionConstruct works correctly with addSplunkSubscriptionFilter set to false", () => {
379+
let stack: Stack
380+
let app: App
381+
let template: assertions.Template
382+
383+
beforeAll(() => {
384+
app = new App()
385+
stack = new Stack(app, "pythonLambdaConstructStack")
386+
new PythonLambdaFunction(stack, "dummyPythonFunction", {
387+
functionName: "testPythonLambda",
388+
projectBaseDir: resolve(__dirname, "../../../.."),
389+
packageBasePath: "packages/cdkConstructs",
390+
handler: "index.handler",
391+
environmentVariables: {foo: "bar"},
392+
logRetentionInDays: 30,
393+
logLevel: "DEBUG",
394+
addSplunkSubscriptionFilter: false
395+
})
396+
template = Template.fromStack(stack)
397+
})
398+
399+
test("it does not have a subscription filter", () => {
400+
template.resourceCountIs("AWS::Logs::SubscriptionFilter", 0)
401+
})
402+
})

0 commit comments

Comments
 (0)