Skip to content

Commit 3934c7b

Browse files
crissupbcrissupb
authored
fix(asea): handle duplicate vpc names (#1286)
* fix(asea): handle duplicate vpc names fix(asea): upgrade installer to node22 * fix(asea): set installer to node:20
1 parent 96c24fd commit 3934c7b

File tree

5 files changed

+55
-36
lines changed

5 files changed

+55
-36
lines changed

‎package.json

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,6 @@
1818
"globals": "15.0.0",
1919
"prettier": "3.0.3",
2020
"typescript-eslint": "^7.6.0"
21-
}
22-
}
21+
},
22+
"packageManager": "pnpm@10.11.0+sha512.6540583f41cc5f628eb3d9773ecee802f4f9ef9923cc45b69890fb47991d4b092964694ec3a4f738a420c918a333062c8b925d312f42e4f0c263eb603551f977"
23+
}

‎reference-artifacts/Custom-Scripts/lza-upgrade/src/asea-config/index.ts

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
* and limitations under the License.
1212
*/
1313
import * as t from './types';
14+
import * as crypto from 'crypto';
1415

1516
export const MandatoryAccountType = t.enums('MandatoryAccountType', [
1617
'master',
@@ -1323,10 +1324,12 @@ export class AcceleratorConfig {
13231324
// Add mandatory account VPC configuration first
13241325
for (const [accountKey, accountConfig] of this.getMandatoryAccountConfigs()) {
13251326
for (const vpcConfig of accountConfig.vpc || []) {
1327+
const lzaVpcName = createLzaVpcName(vpcConfig.name, accountKey, vpcConfig.region);
13261328
vpcConfigs.push({
13271329
accountKey,
13281330
vpcConfig,
13291331
ouKey: accountConfig.ou,
1332+
lzaVpcName
13301333
});
13311334
}
13321335
}
@@ -1346,13 +1349,14 @@ export class AcceleratorConfig {
13461349
continue;
13471350
}
13481351
}
1349-
vpcConfig.lzaVpcName = `${vpcConfig.name}_${accountKey}`;
1352+
vpcConfig.lzaVpcName = createLzaVpcName(vpcConfig.name, accountKey, vpcConfig.region);
13501353
if (vpcConfig['cidr-src'] === 'dynamic') {
1354+
const lzaVpcName = createLzaVpcName(vpcConfig.name, accountKey, vpcConfig.region);
13511355
vpcConfigs.push({
13521356
ouKey,
13531357
accountKey,
13541358
vpcConfig,
1355-
lzaVpcName: `${vpcConfig.name}_${accountKey}`,
1359+
lzaVpcName,
13561360
});
13571361
}
13581362
}
@@ -1361,6 +1365,7 @@ export class AcceleratorConfig {
13611365
ouKey,
13621366
vpcConfig,
13631367
excludeAccounts,
1368+
lzaVpcName: createLzaVpcName(vpcConfig.name, ouKey, vpcConfig.region),
13641369
});
13651370
}
13661371
} else {
@@ -1369,6 +1374,7 @@ export class AcceleratorConfig {
13691374
ouKey,
13701375
accountKey: destinationAccountKey,
13711376
vpcConfig,
1377+
lzaVpcName: createLzaVpcName(vpcConfig.name, destinationAccountKey, vpcConfig.region)
13721378
});
13731379
}
13741380
}
@@ -1381,6 +1387,7 @@ export class AcceleratorConfig {
13811387
accountKey,
13821388
vpcConfig,
13831389
ouKey: accountConfig.ou,
1390+
lzaVpcName: createLzaVpcName(vpcConfig.name, accountKey, vpcConfig.region),
13841391
});
13851392
}
13861393
}
@@ -1406,3 +1413,10 @@ export class AcceleratorConfig {
14061413
}));
14071414
}
14081415
}
1416+
1417+
export function createLzaVpcName(vpcName: string, accountKey: string, region: string): string {
1418+
const md5Hash = crypto.createHash('md5').update(`${vpcName}_${accountKey}_${region}`).digest('hex');
1419+
const vpcNameWithType = vpcName.endsWith('_vpc') ? vpcName : `${vpcName}_vpc`;
1420+
const lzaVpcName = `${vpcNameWithType}..${md5Hash.substring(0,5)}`;
1421+
return lzaVpcName;
1422+
}

‎reference-artifacts/Custom-Scripts/lza-upgrade/src/convert-config.ts

Lines changed: 33 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ import {
3535
TransitGatewayRouteConfig,
3636
VpcConfig,
3737
VpcFlowLogsDestinationConfig,
38+
createLzaVpcName,
3839
} from './asea-config';
3940
import { loadAseaConfig } from './asea-config/load';
4041
import * as WriteToSourcesTypes from './common//utils/types/writeToSourcesTypes';
@@ -539,9 +540,9 @@ export class ConvertAseaConfig {
539540
name: createNetworkFirewallName(firewallConfigName, this.aseaPrefix),
540541
subnetChangeProtection: false,
541542
tags: [],
542-
vpc: createVpcName(lzaVpcName ?? vpcConfig.name),
543+
vpc: lzaVpcName!,
543544
subnets: this.getAzSubnets(vpcConfig, networkFirewallConfig.subnet.name).map((subnet) =>
544-
createSubnetName(lzaVpcName ?? vpcConfig.name, subnet.subnetName, subnet.az),
545+
createSubnetName(vpcConfig.name, subnet.subnetName, subnet.az),
545546
),
546547
});
547548
}
@@ -1776,7 +1777,7 @@ export class ConvertAseaConfig {
17761777
name: instanceNameWithAz,
17771778
account,
17781779
launchTemplate,
1779-
vpc: `${vpcName}_vpc`,
1780+
vpc: firewallScopedVpcConfig?.lzaVpcName!,
17801781
terminationProtection,
17811782
detailedMonitoring,
17821783
tags,
@@ -2432,7 +2433,7 @@ export class ConvertAseaConfig {
24322433
const setConfigRulesConfig = async () => {
24332434
if (!globalOptions['aws-config']) return;
24342435
// TODO: Consider account regions for deploymentTargets
2435-
const currentNodeRuntime = 'nodejs18.x';
2436+
const currentNodeRuntime = 'nodejs20.x';
24362437
const rulesWithTarget: (AwsConfigRule & {
24372438
deployTo?: string[];
24382439
excludedAccounts?: string[];
@@ -2800,7 +2801,7 @@ export class ConvertAseaConfig {
28002801
if (route['target-vpc']) {
28012802
return {
28022803
account: this.getAccountKeyforLza(globalOptions, route['target-account'] || accountKey),
2803-
vpcName: createVpcName(route['target-vpc']),
2804+
vpcName: this.getLzaVpcName(route['target-vpc']),
28042805
};
28052806
} else if (route['target-vpn']) {
28062807
return {
@@ -2967,27 +2968,27 @@ export class ConvertAseaConfig {
29672968
sources: [],
29682969
};
29692970
for (const source of rule.source) {
2970-
let sourceVpcAccountKey: string | undefined = undefined;
2971+
let sourceVpcConfig: ResolvedVpcConfig | undefined;
29712972
if (SubnetSourceConfig.is(source)) {
2972-
sourceVpcAccountKey = this.vpcConfigs.find(({ vpcConfig }) => vpcConfig.name === source.vpc)?.accountKey;
2973+
sourceVpcConfig = this.vpcConfigs.find(({ vpcConfig }) => vpcConfig.name === source.vpc);
29732974
}
29742975
if (SecurityGroupSourceConfig.is(source)) {
2975-
lzaRule.sources.push({
2976+
lzaRule.sources.push({
29762977
securityGroups: source['security-group'].map(securityGroupName),
29772978
});
29782979
} else if (SubnetSourceConfig.is(source)) {
29792980
lzaRule.sources.push({
29802981
//account: this.getAccountKeyforLza(globalOptions, source.account || accountKey || ''),
29812982
account: this.getAccountKeyforLza(
29822983
globalOptions,
2983-
sourceVpcAccountKey || source.account || accountKey || '',
2984+
sourceVpcConfig?.accountKey || source.account || accountKey || '',
29842985
),
29852986
subnets: source.subnet.flatMap((sourceSubnet) =>
29862987
aseaConfig
2987-
.getAzSubnets(sourceVpcAccountKey || source.account || accountKey || '', source.vpc, sourceSubnet)
2988+
.getAzSubnets(sourceVpcConfig?.accountKey || source.account || accountKey || '', source.vpc, sourceSubnet)
29882989
.map((s) => createSubnetName(source.vpc, s.subnetName, s.az)),
29892990
),
2990-
vpc: createVpcName(source.vpc),
2991+
vpc: sourceVpcConfig?.lzaVpcName ?? source.vpc,
29912992
});
29922993
} else {
29932994
lzaRule.sources.push(source);
@@ -3011,7 +3012,6 @@ export class ConvertAseaConfig {
30113012
rules: NaclConfig[],
30123013
vpcConfig: VpcConfig,
30133014
accountKey?: string,
3014-
lzaVpcName?: string,
30153015
) => {
30163016
const lzaRules: (ConvertConfigTypes.LzaNaclInboundRuleType | ConvertConfigTypes.LzaNaclOutboundRuleType)[] = [];
30173017
for (const rule of rules) {
@@ -3055,18 +3055,17 @@ export class ConvertAseaConfig {
30553055
});
30563056
} else {
30573057
// determine which vpc the nacl rule references
3058-
// use the lzaVpcName when the config is from ou
30593058
let destination: string;
30603059
if (dest.vpc === vpcConfig.name) {
3061-
destination = createVpcName(lzaVpcName ?? vpcConfig.name);
3060+
destination = vpcConfig.name;
30623061
} else {
3063-
destination = createVpcName(dest.vpc);
3062+
destination = dest.vpc;
30643063
}
3064+
const destinationAccountKey = destinationVpcKey ? this.getAccountKeyforLza(globalOptions, destinationVpcKey): undefined;
30653065
target = {
3066-
account: destinationVpcKey ? this.getAccountKeyforLza(globalOptions, destinationVpcKey) : undefined,
3066+
account: destinationAccountKey,
30673067
subnet: createSubnetName(dest.vpc, ruleSubnet.subnetName, ruleSubnet.az),
3068-
//vpc: createVpcName(dest.vpc),
3069-
vpc: destination,
3068+
vpc: createLzaVpcName(destination, destinationAccountKey!, vpcConfig.region),
30703069
region: targetRegion,
30713070
};
30723071
}
@@ -3086,7 +3085,7 @@ export class ConvertAseaConfig {
30863085
}
30873086
return lzaRules;
30883087
};
3089-
const prepareNaclConfig = (vpcConfig: VpcConfig, accountKey?: string, lzaVpcName?: string) => {
3088+
const prepareNaclConfig = (vpcConfig: VpcConfig, accountKey?: string) => {
30903089
const naclSubnetConfigs = vpcConfig.subnets?.filter((s) => !!s.nacls);
30913090
if (!naclSubnetConfigs) return;
30923091
const nacls = [];
@@ -3100,8 +3099,8 @@ export class ConvertAseaConfig {
31003099
subnetAssociations: this.getAzSubnets(vpcConfig, subnetConfig.name).map((s) =>
31013100
createSubnetName(vpcConfig.name, s.subnetName, s.az),
31023101
),
3103-
inboundRules: prepareNaclRules(inboundRules, vpcConfig, accountKey, lzaVpcName),
3104-
outboundRules: prepareNaclRules(outboundRules, vpcConfig, accountKey, lzaVpcName),
3102+
inboundRules: prepareNaclRules(inboundRules, vpcConfig, accountKey),
3103+
outboundRules: prepareNaclRules(outboundRules, vpcConfig, accountKey),
31053104
});
31063105
}
31073106
return nacls;
@@ -3205,14 +3204,15 @@ export class ConvertAseaConfig {
32053204
vpcConfig: VpcConfig,
32063205
lzaEndpointsConfig: ConvertConfigTypes.ResolverEndpointsType[],
32073206
lzaEndpointsRulesConfig: ConvertConfigTypes.ResolverEndpointRulesType[],
3207+
accountKey: string | undefined,
32083208
): ConvertConfigTypes.ResolverEndpointsType[] => {
32093209
let inboundResolver = vpcConfig.resolvers!.inbound;
32103210
let outboundResolver = vpcConfig.resolvers!.outbound;
32113211
if (vpcConfig.resolvers) {
32123212
if (inboundResolver) {
32133213
lzaEndpointsConfig.push({
32143214
name: `${vpcConfig.name}InboundEndpoint`,
3215-
vpc: createVpcName(vpcConfig.lzaVpcName ?? vpcConfig.name),
3215+
vpc: createLzaVpcName(vpcConfig.name, accountKey!, vpcConfig.region),
32163216
subnets:
32173217
vpcConfig.subnets
32183218
?.find((subnetItem) => subnetItem.name === vpcConfig.resolvers?.subnet)
@@ -3226,7 +3226,7 @@ export class ConvertAseaConfig {
32263226
if (outboundResolver) {
32273227
lzaEndpointsConfig.push({
32283228
name: `${vpcConfig.name}OutboundEndpoint`,
3229-
vpc: createVpcName(vpcConfig.lzaVpcName ?? vpcConfig.name),
3229+
vpc: createLzaVpcName(vpcConfig.name, accountKey!, vpcConfig.region),
32303230
subnets:
32313231
vpcConfig.subnets
32323232
?.find((subnetItem) => subnetItem.name === vpcConfig.resolvers?.subnet)
@@ -3262,7 +3262,7 @@ export class ConvertAseaConfig {
32623262
return lzaEndpointsRulesConfig;
32633263
};
32643264

3265-
const prepareResolverConfig = (vpcConfig: VpcConfig) => {
3265+
const prepareResolverConfig = (vpcConfig: VpcConfig, accountKey: string | undefined) => {
32663266
let lzaResolverConfig: {
32673267
endpoints: ConvertConfigTypes.ResolverEndpointsType[] | undefined;
32683268
queryLogs: { name: string; destinations: string[] } | undefined;
@@ -3274,7 +3274,7 @@ export class ConvertAseaConfig {
32743274
let endpoints: any[] = [];
32753275
if (vpcConfig.resolvers) {
32763276
rules = prepareRulesConfig(vpcConfig, lzaEndpointsRulesConfig);
3277-
endpoints = prepareEndpointsConfig(vpcConfig, lzaEndpointsConfig, rules!);
3277+
endpoints = prepareEndpointsConfig(vpcConfig, lzaEndpointsConfig, rules!, accountKey);
32783278
}
32793279

32803280
lzaResolverConfig = {
@@ -3419,7 +3419,7 @@ export class ConvertAseaConfig {
34193419

34203420
const prepareVpcConfig = ({ accountKey, ouKey, vpcConfig, excludeAccounts, lzaVpcName }: ResolvedVpcConfig) => {
34213421
return {
3422-
name: createVpcName(lzaVpcName ?? vpcConfig.name),
3422+
name: lzaVpcName ?? createVpcName(vpcConfig.name),
34233423
account: accountKey ? this.getAccountKeyforLza(globalOptions, accountKey) : undefined,
34243424
deploymentTargets: !accountKey
34253425
? {
@@ -3458,13 +3458,13 @@ export class ConvertAseaConfig {
34583458
useCentralEndpoints: vpcConfig['use-central-endpoints'],
34593459
natGateways: prepareNatGatewayConfig(vpcConfig),
34603460
securityGroups: prepareSecurityGroupsConfig(vpcConfig, accountKey),
3461-
networkAcls: prepareNaclConfig(vpcConfig, accountKey, lzaVpcName),
3461+
networkAcls: prepareNaclConfig(vpcConfig, accountKey),
34623462
vpcFlowLogs: prepareVpcFlowLogs(vpcConfig['flow-logs']),
34633463
subnets: prepareSubnetConfig(vpcConfig, ouKey, accountKey),
34643464
transitGatewayAttachments: prepareTgwAttachConfig(vpcConfig),
34653465
virtualPrivateGateway: vpcConfig.vgw,
34663466
routeTables: prepareRouteTableConfig(vpcConfig, accountKey),
3467-
vpcRoute53Resolver: prepareResolverConfig(vpcConfig),
3467+
vpcRoute53Resolver: prepareResolverConfig(vpcConfig, accountKey),
34683468
};
34693469
};
34703470

@@ -3493,7 +3493,7 @@ export class ConvertAseaConfig {
34933493
.filter(({ vpcConfig }) => !!vpcConfig.pcx)
34943494
.map(({ vpcConfig }) => ({
34953495
name: peeringConnectionName(vpcConfig.name, vpcConfig.pcx!['source-vpc']),
3496-
vpcs: [createVpcName(vpcConfig.lzaVpcName ?? vpcConfig.name), createVpcName(vpcConfig.pcx!['source-vpc'])],
3496+
vpcs: [this.getLzaVpcName(vpcConfig.name), this.getLzaVpcName(vpcConfig.pcx!['source-vpc'])],
34973497
}));
34983498
};
34993499
await setCertificatesConfig();
@@ -3660,6 +3660,10 @@ export class ConvertAseaConfig {
36603660
);
36613661
}
36623662

3663+
private getLzaVpcName(vpcName: string): string {
3664+
return this.vpcConfigs.find((vc) => vc.vpcConfig.name === vpcName )?.lzaVpcName!
3665+
}
3666+
36633667
private getVpcCidr({ accountKey, vpcConfig, ouKey }: { accountKey?: string; vpcConfig: VpcConfig; ouKey?: string }) {
36643668
const cidrs: string[] = [];
36653669
if (vpcConfig['cidr-src'] === 'provided') {

‎src/installer/cdk/src/index.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -279,7 +279,7 @@ class Installer extends cdk.Stack {
279279
nodejs: 22,
280280
},
281281
commands: [
282-
'npm install --global pnpm@10.4.1',
282+
'npm install --global pnpm@10.11.0',
283283
'pnpm install --frozen-lockfile',
284284
'pnpm recursive run build',
285285
],

‎src/lib/cdk-accelerator/src/codebuild/cdk-deploy-project.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,7 @@ export class PrebuiltCdkDeployProject extends CdkDeployProjectBase {
146146
fs.writeFileSync(
147147
path.join(this.projectTmpDir, 'Dockerfile'),
148148
[
149-
'FROM public.ecr.aws/bitnami/node:18',
149+
'FROM public.ecr.aws/bitnami/node:22',
150150
// Install the package manager
151151
...installPackageManagerCommands(props.packageManager).map(cmd => `RUN ${cmd}`),
152152
`WORKDIR ${appDir}`,
@@ -194,7 +194,7 @@ export class PrebuiltCdkDeployProject extends CdkDeployProjectBase {
194194
*/
195195
function installPackageManagerCommands(packageManager: PackageManager) {
196196
if (packageManager === 'pnpm') {
197-
return ['npm install --global pnpm@10.4.1'];
197+
return ['npm install --global pnpm@10.11.0'];
198198
}
199199
throw new Error(`Unsupported package manager ${packageManager}`);
200200
}

0 commit comments

Comments
 (0)