| 25 | class Oracle(Stack): |
| 26 | |
| 27 | def __init__(self, scope:Construct, id:str, |
| 28 | vpc_id:str, ## vpc id |
| 29 | subnet_ids:list, ## list of subnet ids |
| 30 | db_name:str, ## database name |
| 31 | instance_type = ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.LARGE), ## ec2.InstanceType |
| 32 | ## |
| 33 | ## https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_rds/OracleEngineVersion.html#aws_cdk.aws_rds.OracleEngineVersion |
| 34 | ## |
| 35 | engine_version = rds.OracleEngineVersion.VER_19_0_0_0_2021_04_R1, |
| 36 | oracle_username:str="dbadmin", |
| 37 | backup_retention_days:int=14, |
| 38 | backup_window:str="00:15-01:15", |
| 39 | preferred_maintenance_window:str="Sun:23:45-Mon:00:15", |
| 40 | ingress_sources:list=[], ## A security group object or a network subnet |
| 41 | ## ec2.Peer.ipv4("0.0.0.0/0") |
| 42 | ## ec2.SecurityGroup |
| 43 | **kwargs) -> None: |
| 44 | super().__init__(scope, id, **kwargs) |
| 45 | |
| 46 | |
| 47 | |
| 48 | ############################################ |
| 49 | ## |
| 50 | ## CDK Nag - https://pypi.org/project/cdk-nag/ |
| 51 | ## https://github.com/cdklabs/cdk-nag |
| 52 | ## |
| 53 | ## CDK Nag Checks for AWS Engagement Solutions Secuirty Rules: |
| 54 | ## https://github.com/cdklabs/cdk-nag/blob/main/RULES.md#awssolutions |
| 55 | ## Also checks for: |
| 56 | ## HIPAA Security |
| 57 | ## NIST 800-53 rev 4 |
| 58 | ## NIST 800-53 rev 5 |
| 59 | ## |
| 60 | ############################################ |
| 61 | Aspects.of(self).add(AwsSolutionsChecks()) |
| 62 | ## |
| 63 | ## Supressed Errors |
| 64 | ## |
| 65 | NagSuppressions.add_stack_suppressions(self, [{"id":"AwsSolutions-IAM4", "reason":"TODO: Stop using AWS managed policies."}]) |
| 66 | NagSuppressions.add_stack_suppressions(self, [{"id":"AwsSolutions-IAM5", "reason":"TODO: Remove Wildcards in IAM roles."}]) |
| 67 | NagSuppressions.add_stack_suppressions(self, [{"id":"AwsSolutions-RDS11","reason":"Default Oracle ports is fine."}]) |
| 68 | ## |
| 69 | ## Supressed Warnings |
| 70 | ## |
| 71 | NagSuppressions.add_stack_suppressions(self, [{"id":"AwsSolutions-RDS16", "reason":"parameter referencing an intrinsic function"}]) |
| 72 | NagSuppressions.add_stack_suppressions(self, [{"id":"AwsSolutions-SMG4", "reason":"Don't rotate secrets. Remove in prod"}]) |
| 73 | |
| 74 | |
| 75 | azs = Fn.get_azs() |
| 76 | |
| 77 | vpc = ec2.Vpc.from_vpc_attributes(self, 'ExistingVPC', availability_zones=azs, vpc_id=vpc_id) |
| 78 | subnets = list() |
| 79 | for subnet_id in subnet_ids: |
| 80 | subnets.append(ec2.Subnet.from_subnet_attributes(self, subnet_id.replace("-", "").replace("_", "").replace(" ", ""), subnet_id=subnet_id)) |
| 81 | |
| 82 | vpc_subnets = ec2.SubnetSelection(subnets=subnets) |
| 83 | |
| 84 | allAll = ec2.Port(protocol=ec2.Protocol("ALL"), string_representation="ALL") |