@makemydeal/cdk-dr-constructs

This package contains DR specific implementations of most of the types above. This will take some opinions from Accelerate, for example, using the SSM Parameter Store to retrieve ARN values for IAM roles.

Constructs

Name	Description
Encryption	Reads an Encryption Key from SSM /dr/global/encryption/{keyName} where Keyname is a property passed
IAM	Reads 7 different IAM roles from SSM all in /dr/global/iam. CodeBuild (NonProd and Prod), CodePipeline (NonProd and Prod), CloudFormation (NonProd and Prod) along with Lambda Execution Role (read during build from the appropriate account)
SsmProperties	Class to read SSM properties.
VpcConfig	Given a VpcId, SecurityGroup Ids and Subnet Ids it will read these resources from the account/region given to the stack. VPC requires concrete values to be read (cannot come from SSM or other dynamic sources)
VpcEndpoint	Given a VpcConfig, it can read an existing VPC Endpoint or create a new one.

Factories

The following factories exist to build their corresponding construct above. This allows these factories to be passed to the main stack allowing you to customize construction of the objects or supply your own object with your implementation.

• EncryptionFactory
• EncryptionFactoryProps (takes properties to specify region or a different key)
• IamFactory
• SsmPropertiesFactory
• VpcConfigFactory

Usage

import { VpcConfigFactory } from '@makemydeal/cdk-dr-constructs';

const factory = VpcConfigFactory({
    // VPC Configuration coming from the process.env variables from CodeBuild.  These NEED to be concrete, cannot come from SSM directly in the stack
    vpcId,
    securityGroupIds,
    subnetIds
})

Parameter Store Dependencies

All Deployments

Key	Construct	Description
/dr/global/iam/code-build-service-role	IAM	Code Build Service Role
/dr/global/iam/crossaccount-build-role	IAM	Role used for cross account builds (production)
/dr/global/iam/code-pipeline-service-role	IAM	Code Pipeline Service Role
/dr/global/iam/crossaccount-deploy-role	IAM	Role used for cross account deployment (production)
/dr/global/iam/cfn-service-role-prod	IAM	Production Account CloudFormation role
/dr/global/iam/cfn-service-role	IAM	Non-Production Account CloudFormation role
/dr/global/iam/lambda-execution-role	IAM	Lambda Execution Role
/dr/global/iam/s3-replication-role	IAM	Role used to set up replication between s3 buckets
/dr/global/certificates/makemydealcom	DRCertificate	Default ARN to use for Certificate
/dr/global/network/hosted-zone-ids/makemydealcom	DRHostedZone	Default Hosted Zone ID

Single Region Deployments

To support backward compatibility, we will support the existing keys when a region is not specified.

Key	Construct	Description
/dr/global/encryption/basicKey	Encryption	KMS key used for encryption

Multi Region Deployments

For multi region deployments, we need to support a region for these values. This is used in the pipeline only so the keys change

Key	Construct	Description
/dr/global/cdk/regions/${region}/encryption/basicKey	Encryption	KMS key used for encryption