
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
@cdklabs/cdk-ecs-codedeploy
Advanced tools
CDK Constructs for performing ECS Deployments with CodeDeploy
This project contains CDK constructs to create CodeDeploy ECS deployments.
yarn add @cdklabs/cdk-ecs-codedeploy
CodeDeploy for ECS can manage the deployment of new task definitions to ECS services. Only 1 deployment construct can be defined for a given EcsDeploymentGroup.
declare const deploymentGroup: codeDeploy.IEcsDeploymentGroup;
declare const taskDefinition: ecs.ITaskDefinition;
new EcsDeployment({
deploymentGroup,
targetService: {
taskDefinition,
containerName: 'mycontainer',
containerPort: 80,
},
});
The deployment will use the AutoRollbackConfig for the EcsDeploymentGroup unless it is overridden in the deployment:
declare const deploymentGroup: codeDeploy.IEcsDeploymentGroup;
declare const taskDefinition: ecs.ITaskDefinition;
new EcsDeployment({
deploymentGroup,
targetService: {
taskDefinition,
containerName: 'mycontainer',
containerPort: 80,
},
autoRollback: {
failedDeployment: true,
deploymentInAlarm: true,
stoppedDeployment: false,
},
});
By default, the deployment will timeout after 30 minutes. The timeout value can be overridden:
declare const deploymentGroup: codeDeploy.IEcsDeploymentGroup;
declare const taskDefinition: ecs.ITaskDefinition;
new EcsDeployment({
deploymentGroup,
targetService: {
taskDefinition,
containerName: 'mycontainer',
containerPort: 80,
},
timeout: Duration.minutes(60),
});
CodeDeploy can leverage Cloudwatch Alarms to trigger automatic rollbacks. The ApiCanary
construct simplifies the process for creating CloudWatch Synthetics Canaries to monitor APIs. The following code demonstrates a canary that monitors https://xkcd.com/908/info.0.json and checks the JSON response to assert that safe_title
has the value of 'The Cloud'
.
const canary = new ApiCanary(stack, 'Canary', {
baseUrl: 'https://xkcd.com',
durationAlarmThreshold: Duration.seconds(5),
threadCount: 5,
steps: [
{
name: 'info',
path: '/908/info.0.json',
jmesPath: 'safe_title',
expectedValue: 'The Cloud',
},
],
});
An L3 construct named ApplicationLoadBalancedCodeDeployedFargateService
extends ApplicationLoadBalancedFargateService and adds support for deploying new versions of the service with AWS CodeDeploy. Additionally, an Amazon CloudWatch Synthetic canary is created via the ApiCanary
construct and is monitored by the CodeDeploy deployment to trigger rollback if the canary begins to alarm.
declare const cluster: ecs.ICluster;
declare const image: ecs.ContainerImage;
const service = new ApplicationLoadBalancedCodeDeployedFargateService(stack, 'Service', {
cluster,
taskImageOptions: {
image,
},
apiTestSteps: [{
name: 'health',
path: '/health',
jmesPath: 'status',
expectedValue: 'ok',
}],
});
yarn install
yarn build
yarn test
To run an integration test and update the snapshot, run:
yarn integ:ecs-deployment:deploy
To recreate snapshots for integration tests, run:
yarn integ:snapshot-all
See CONTRIBUTING for more information.
This project is licensed under the Apache-2.0 License.
FAQs
CDK Constructs for performing ECS Deployments with CodeDeploy
We found that @cdklabs/cdk-ecs-codedeploy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.