Skip to content

Commit 672e1ec

Browse files
David-O-MDavid-O-M
authored
Implement Vechain into AWS node runner (#212)
* Implement Vechain into AWS node runner * Add package.json * Commit package.json * Add CDK Nag AWS Solutions Checks for security compliance --------- Co-authored-by: David-O-M <>
1 parent e9a94a5 commit 672e1ec

38 files changed

+8755
-19
lines changed

‎lib/constructs/ha-rpc-nodes-with-alb.ts‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ export interface HANodesConstructCustomProps {
2222
rpcPortForALB: number,
2323
albHealthCheckGracePeriodMin: number;
2424
healthCheckPath? : string;
25+
healthCheckPort?: number;
2526
heartBeatDelayMin: number;
2627
lifecycleHookName: string;
2728
autoScalingGroupName: string;
@@ -48,6 +49,7 @@ export class HANodesConstruct extends cdkContructs.Construct {
4849
rpcPortForALB,
4950
albHealthCheckGracePeriodMin,
5051
healthCheckPath,
52+
healthCheckPort,
5153
heartBeatDelayMin,
5254
lifecycleHookName,
5355
autoScalingGroupName,
@@ -183,7 +185,7 @@ export class HANodesConstruct extends cdkContructs.Construct {
183185
healthyHttpCodes: "200-299",
184186
path: healthCheckPath ? healthCheckPath : "/",
185187
// In the future, can create a separate service to have a more reliable health check
186-
port: rpcPortForALB.toString(),
188+
port: (healthCheckPort ? healthCheckPort : rpcPortForALB).toString(),
187189
unhealthyThresholdCount: 2,
188190
healthyThresholdCount: 3,
189191
interval: cdk.Duration.seconds(30),

‎lib/vechain/.gitignore‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
*.js
2+
!jest.config.js
3+
*.d.ts
4+
node_modules
5+
6+
# CDK asset staging directory
7+
.cdk.staging
8+
cdk.out

‎lib/vechain/.npmignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
*.ts
2+
!*.d.ts
3+
4+
# CDK asset staging directory
5+
.cdk.staging
6+
cdk.out

‎lib/vechain/README.md‎

Lines changed: 310 additions & 0 deletions
Large diffs are not rendered by default.

‎lib/vechain/app.ts‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
import * as cdk from "aws-cdk-lib";
2+
import "dotenv/config";
3+
import { VetCommonStack } from "./lib/common-stack";
4+
import * as config from "./lib/config/node-config";
5+
import { VETHaNodeStack } from "./lib/ha-node-stack";
6+
import { VETSingleNodeStack } from "./lib/single-node-stack";
7+
import * as nag from "cdk-nag";
8+
9+
const app = new cdk.App();
10+
cdk.Tags.of(app).add("Project", "AWSVet");
11+
12+
const commonStack = new VetCommonStack(app, "vet-common", {
13+
stackName: `vet-common`,
14+
env: { account: config.baseConfig.accountId, region: config.baseConfig.region },
15+
});
16+
17+
new VETSingleNodeStack(app, `vet-single-node`, {
18+
env: { account: config.baseConfig.accountId, region: config.baseConfig.region },
19+
vetNodeType: config.baseNodeConfig.vetNodeType,
20+
syncFromPublicSnapshot: config.baseNodeConfig.syncFromPublicSnapshot,
21+
instanceType: config.baseNodeConfig.instanceType,
22+
instanceCpuType: config.baseNodeConfig.instanceCpuType,
23+
dataVolume: config.baseNodeConfig.dataVolume,
24+
network: config.baseNodeConfig.network,
25+
vetContainerImage: config.baseNodeConfig.vetContainerImage,
26+
instanceRole: commonStack.instanceRole,
27+
});
28+
29+
// Note: The Load balancer is not exposed to the public internet
30+
// therefore you can only access the nodes from within the VPC
31+
// HA nodes are only supported for public nodes
32+
new VETHaNodeStack(app, `vet-ha-node`, {
33+
env: { account: config.baseConfig.accountId, region: config.baseConfig.region },
34+
vetNodeType: config.baseNodeConfig.vetNodeType,
35+
syncFromPublicSnapshot: config.baseNodeConfig.syncFromPublicSnapshot,
36+
instanceType: config.baseNodeConfig.instanceType,
37+
instanceCpuType: config.baseNodeConfig.instanceCpuType,
38+
dataVolume: config.baseNodeConfig.dataVolume,
39+
network: config.baseNodeConfig.network,
40+
vetContainerImage: config.baseNodeConfig.vetContainerImage,
41+
instanceRole: commonStack.instanceRole,
42+
albHealthCheckGracePeriodMin: config.haNodeConfig.albHealthCheckGracePeriodMin,
43+
heartBeatDelayMin: config.haNodeConfig.heartBeatDelayMin,
44+
numberOfNodes: config.haNodeConfig.numberOfNodes,
45+
});
46+
47+
// Security Check
48+
cdk.Aspects.of(app).add(
49+
new nag.AwsSolutionsChecks({
50+
verbose: false,
51+
reports: true,
52+
logIgnores: false,
53+
})
54+
);

‎lib/vechain/cdk.json‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
{
2+
"app": "npx ts-node --prefer-ts-exts app.ts",
3+
"watch": {
4+
"include": [
5+
"**"
6+
],
7+
"exclude": [
8+
"README.md",
9+
"cdk*.json",
10+
"**/*.d.ts",
11+
"**/*.js",
12+
"tsconfig.json",
13+
"package*.json",
14+
"yarn.lock",
15+
"node_modules",
16+
"test"
17+
]
18+
},
19+
"context": {
20+
"@aws-cdk/aws-lambda:recognizeLayerVersion": true,
21+
"@aws-cdk/core:checkSecretUsage": true,
22+
"@aws-cdk/core:target-partitions": [
23+
"aws",
24+
"aws-cn"
25+
],
26+
"@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver": true,
27+
"@aws-cdk/aws-ec2:uniqueImdsv2TemplateName": true,
28+
"@aws-cdk/aws-ecs:arnFormatIncludesClusterName": true,
29+
"@aws-cdk/aws-iam:minimizePolicies": true,
30+
"@aws-cdk/core:validateSnapshotRemovalPolicy": true,
31+
"@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName": true,
32+
"@aws-cdk/aws-s3:createDefaultLoggingPolicy": true,
33+
"@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption": true,
34+
"@aws-cdk/aws-apigateway:disableCloudWatchRole": true,
35+
"@aws-cdk/core:enablePartitionLiterals": true,
36+
"@aws-cdk/aws-events:eventsTargetQueueSameAccount": true,
37+
"@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker": true,
38+
"@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName": true,
39+
"@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy": true,
40+
"@aws-cdk/aws-route53-patters:useCertificate": true,
41+
"@aws-cdk/customresources:installLatestAwsSdkDefault": false,
42+
"@aws-cdk/aws-rds:databaseProxyUniqueResourceName": true,
43+
"@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup": true,
44+
"@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId": true,
45+
"@aws-cdk/aws-ec2:launchTemplateDefaultUserData": true,
46+
"@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments": true,
47+
"@aws-cdk/aws-redshift:columnId": true,
48+
"@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2": true,
49+
"@aws-cdk/aws-ec2:restrictDefaultSecurityGroup": true,
50+
"@aws-cdk/aws-apigateway:requestValidatorUniqueId": true,
51+
"@aws-cdk/aws-kms:aliasNameRef": true,
52+
"@aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfig": true,
53+
"@aws-cdk/core:includePrefixInUniqueNameGeneration": true,
54+
"@aws-cdk/aws-efs:denyAnonymousAccess": true,
55+
"@aws-cdk/aws-opensearchservice:enableOpensearchMultiAzWithStandby": true,
56+
"@aws-cdk/aws-lambda-nodejs:useLatestRuntimeVersion": true,
57+
"@aws-cdk/aws-efs:mountTargetOrderInsensitiveLogicalId": true,
58+
"@aws-cdk/aws-rds:auroraClusterChangeScopeOfInstanceParameterGroupWithEachParameters": true,
59+
"@aws-cdk/aws-appsync:useArnForSourceApiAssociationIdentifier": true,
60+
"@aws-cdk/aws-rds:preventRenderingDeprecatedCredentials": true,
61+
"@aws-cdk/aws-codepipeline-actions:useNewDefaultBranchForCodeCommitSource": true,
62+
"@aws-cdk/aws-cloudwatch-actions:changeLambdaPermissionLogicalIdForLambdaAction": true,
63+
"@aws-cdk/aws-codepipeline:crossAccountKeysDefaultValueToFalse": true,
64+
"@aws-cdk/aws-codepipeline:defaultPipelineTypeToV2": true,
65+
"@aws-cdk/aws-kms:reduceCrossAccountRegionPolicyScope": true,
66+
"@aws-cdk/aws-eks:nodegroupNameAttribute": true,
67+
"@aws-cdk/aws-ec2:ebsDefaultGp3Volume": true,
68+
"@aws-cdk/aws-ecs:removeDefaultDeploymentAlarm": true,
69+
"@aws-cdk/custom-resources:logApiResponseDataPropertyTrueDefault": false,
70+
"@aws-cdk/aws-s3:keepNotificationInImportedBucket": false,
71+
"@aws-cdk/aws-ecs:enableImdsBlockingDeprecatedFeature": false,
72+
"@aws-cdk/aws-ecs:disableEcsImdsBlocking": true,
73+
"@aws-cdk/aws-ecs:reduceEc2FargateCloudWatchPermissions": true,
74+
"@aws-cdk/aws-dynamodb:resourcePolicyPerReplica": true,
75+
"@aws-cdk/aws-ec2:ec2SumTImeoutEnabled": true,
76+
"@aws-cdk/aws-appsync:appSyncGraphQLAPIScopeLambdaPermission": true,
77+
"@aws-cdk/aws-rds:setCorrectValueForDatabaseInstanceReadReplicaInstanceResourceId": true,
78+
"@aws-cdk/core:cfnIncludeRejectComplexResourceUpdateCreatePolicyIntrinsics": true,
79+
"@aws-cdk/aws-lambda-nodejs:sdkV3ExcludeSmithyPackages": true,
80+
"@aws-cdk/aws-stepfunctions-tasks:fixRunEcsTaskPolicy": true,
81+
"@aws-cdk/aws-ec2:bastionHostUseAmazonLinux2023ByDefault": true,
82+
"@aws-cdk/aws-route53-targets:userPoolDomainNameMethodWithoutCustomResource": true,
83+
"@aws-cdk/aws-elasticloadbalancingV2:albDualstackWithoutPublicIpv4SecurityGroupRulesDefault": true,
84+
"@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections": true,
85+
"@aws-cdk/core:enableAdditionalMetadataCollection": true,
86+
"@aws-cdk/aws-lambda:createNewPoliciesWithAddToRolePolicy": false,
87+
"@aws-cdk/aws-s3:setUniqueReplicationRoleName": true,
88+
"@aws-cdk/aws-events:requireEventBusPolicySid": true,
89+
"@aws-cdk/core:aspectPrioritiesMutating": true,
90+
"@aws-cdk/aws-dynamodb:retainTableReplica": true,
91+
"@aws-cdk/aws-stepfunctions:useDistributedMapResultWriterV2": true,
92+
"@aws-cdk/s3-notifications:addS3TrustKeyPolicyForSnsSubscriptions": true,
93+
"@aws-cdk/aws-ec2:requirePrivateSubnetsForEgressOnlyInternetGateway": true,
94+
"@aws-cdk/aws-s3:publicAccessBlockedByDefault": true,
95+
"@aws-cdk/aws-lambda:useCdkManagedLogGroup": true
96+
}
97+
}

‎lib/vechain/doc/assets/ha-architecture.png‎

154 KB
Loading

0 commit comments

Comments
 (0)