{ "Parameters": { "DomainName": { "Type": "String", "AllowedPattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$", "ConstraintDescription": "a lowercase DNS name with at least one dot, no scheme, no trailing dot", "Description": "The appliance's domain, e.g. brainbase.example.com. The hosts app./api./llm./supabase./hooks. are created under it." }, "HostedZoneId": { "Type": "AWS::Route53::HostedZone::Id", "Description": "PUBLIC Route 53 hosted zone that serves DomainName. ACM validation records and the host aliases are written into it." }, "AlarmEmail": { "Type": "String", "AllowedPattern": "^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$", "ConstraintDescription": "an email address", "Description": "Address subscribed to the appliance's alarm topic. Confirm the SNS subscription email after install." }, "FirstUserEmail": { "Type": "String", "Default": "", "AllowedPattern": "^$|^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$", "ConstraintDescription": "an email address, or empty to skip first-user provisioning", "Description": "First Brainbase user to provision. Sign in with a magic link once SES can deliver to this inbox. Existing users are never changed. Empty keeps manual user provisioning." }, "AppAllowedCidrs": { "Type": "CommaDelimitedList", "Default": "", "AllowedPattern": "^$|^(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(\\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}/(8|1[6-9]|2[0-9]|3[0-2])$", "ConstraintDescription": "each entry an IPv4 CIDR with prefix /8 or /16-/32 (e.g. 203.0.113.0/24); IPv6 is not supported here; or empty", "Description": "Optional. IPv4 CIDRs (/8 or /16-/32) allowed to reach the web app host; leave empty to allow all. The API and Supabase hosts are never restricted (machine traffic)." } }, "Resources": { "NetworkVpc7FB7348F": { "Type": "AWS::EC2::VPC", "Properties": { "CidrBlock": "10.0.0.0/16", "EnableDnsHostnames": true, "EnableDnsSupport": true, "InstanceTenancy": "default", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" }, { "Key": "Name", "Value": "bb-appliance-vpc" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/Resource" } }, "NetworkVpcpublicSubnet1Subnet00617657": { "Type": "AWS::EC2::Subnet", "Properties": { "AvailabilityZone": { "Fn::Select": [ 0, { "Fn::GetAZs": "" } ] }, "CidrBlock": "10.0.0.0/24", "MapPublicIpOnLaunch": true, "Tags": [ { "Key": "aws-cdk:subnet-name", "Value": "public" }, { "Key": "aws-cdk:subnet-type", "Value": "Public" }, { "Key": "brainbase-appliance", "Value": "v1" }, { "Key": "Name", "Value": "BrainbaseAppliance/Network/Vpc/publicSubnet1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/publicSubnet1/Subnet" } }, "NetworkVpcpublicSubnet1RouteTableDFE49ED6": { "Type": "AWS::EC2::RouteTable", "Properties": { "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" }, { "Key": "Name", "Value": "BrainbaseAppliance/Network/Vpc/publicSubnet1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/publicSubnet1/RouteTable" } }, "NetworkVpcpublicSubnet1RouteTableAssociation203B743E": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "RouteTableId": { "Ref": "NetworkVpcpublicSubnet1RouteTableDFE49ED6" }, "SubnetId": { "Ref": "NetworkVpcpublicSubnet1Subnet00617657" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/publicSubnet1/RouteTableAssociation" } }, "NetworkVpcpublicSubnet1DefaultRoute19622567": { "Type": "AWS::EC2::Route", "Properties": { "DestinationCidrBlock": "0.0.0.0/0", "GatewayId": { "Ref": "NetworkVpcIGW6BEA7B02" }, "RouteTableId": { "Ref": "NetworkVpcpublicSubnet1RouteTableDFE49ED6" } }, "DependsOn": [ "NetworkVpcVPCGW8F3799B5" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/publicSubnet1/DefaultRoute" } }, "NetworkVpcpublicSubnet1EIPC41EF705": { "Type": "AWS::EC2::EIP", "Properties": { "Domain": "vpc", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" }, { "Key": "Name", "Value": "BrainbaseAppliance/Network/Vpc/publicSubnet1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/publicSubnet1/EIP" } }, "NetworkVpcpublicSubnet1NATGateway939C8F7E": { "Type": "AWS::EC2::NatGateway", "Properties": { "AllocationId": { "Fn::GetAtt": [ "NetworkVpcpublicSubnet1EIPC41EF705", "AllocationId" ] }, "SubnetId": { "Ref": "NetworkVpcpublicSubnet1Subnet00617657" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" }, { "Key": "Name", "Value": "BrainbaseAppliance/Network/Vpc/publicSubnet1" } ] }, "DependsOn": [ "NetworkVpcpublicSubnet1DefaultRoute19622567", "NetworkVpcpublicSubnet1RouteTableAssociation203B743E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/publicSubnet1/NATGateway" } }, "NetworkVpcpublicSubnet2SubnetDCAA7C9A": { "Type": "AWS::EC2::Subnet", "Properties": { "AvailabilityZone": { "Fn::Select": [ 1, { "Fn::GetAZs": "" } ] }, "CidrBlock": "10.0.1.0/24", "MapPublicIpOnLaunch": true, "Tags": [ { "Key": "aws-cdk:subnet-name", "Value": "public" }, { "Key": "aws-cdk:subnet-type", "Value": "Public" }, { "Key": "brainbase-appliance", "Value": "v1" }, { "Key": "Name", "Value": "BrainbaseAppliance/Network/Vpc/publicSubnet2" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/publicSubnet2/Subnet" } }, "NetworkVpcpublicSubnet2RouteTable216E89B0": { "Type": "AWS::EC2::RouteTable", "Properties": { "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" }, { "Key": "Name", "Value": "BrainbaseAppliance/Network/Vpc/publicSubnet2" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/publicSubnet2/RouteTable" } }, "NetworkVpcpublicSubnet2RouteTableAssociationA4B52C34": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "RouteTableId": { "Ref": "NetworkVpcpublicSubnet2RouteTable216E89B0" }, "SubnetId": { "Ref": "NetworkVpcpublicSubnet2SubnetDCAA7C9A" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/publicSubnet2/RouteTableAssociation" } }, "NetworkVpcpublicSubnet2DefaultRouteF6C22611": { "Type": "AWS::EC2::Route", "Properties": { "DestinationCidrBlock": "0.0.0.0/0", "GatewayId": { "Ref": "NetworkVpcIGW6BEA7B02" }, "RouteTableId": { "Ref": "NetworkVpcpublicSubnet2RouteTable216E89B0" } }, "DependsOn": [ "NetworkVpcVPCGW8F3799B5" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/publicSubnet2/DefaultRoute" } }, "NetworkVpcappSubnet1SubnetE208FB5D": { "Type": "AWS::EC2::Subnet", "Properties": { "AvailabilityZone": { "Fn::Select": [ 0, { "Fn::GetAZs": "" } ] }, "CidrBlock": "10.0.16.0/20", "MapPublicIpOnLaunch": false, "Tags": [ { "Key": "aws-cdk:subnet-name", "Value": "app" }, { "Key": "aws-cdk:subnet-type", "Value": "Private" }, { "Key": "brainbase-appliance", "Value": "v1" }, { "Key": "Name", "Value": "BrainbaseAppliance/Network/Vpc/appSubnet1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/appSubnet1/Subnet" } }, "NetworkVpcappSubnet1RouteTableE1AE5577": { "Type": "AWS::EC2::RouteTable", "Properties": { "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" }, { "Key": "Name", "Value": "BrainbaseAppliance/Network/Vpc/appSubnet1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/appSubnet1/RouteTable" } }, "NetworkVpcappSubnet1RouteTableAssociationC7D57458": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "RouteTableId": { "Ref": "NetworkVpcappSubnet1RouteTableE1AE5577" }, "SubnetId": { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/appSubnet1/RouteTableAssociation" } }, "NetworkVpcappSubnet1DefaultRoute579AB742": { "Type": "AWS::EC2::Route", "Properties": { "DestinationCidrBlock": "0.0.0.0/0", "NatGatewayId": { "Ref": "NetworkVpcpublicSubnet1NATGateway939C8F7E" }, "RouteTableId": { "Ref": "NetworkVpcappSubnet1RouteTableE1AE5577" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/appSubnet1/DefaultRoute" } }, "NetworkVpcappSubnet2SubnetC46F4198": { "Type": "AWS::EC2::Subnet", "Properties": { "AvailabilityZone": { "Fn::Select": [ 1, { "Fn::GetAZs": "" } ] }, "CidrBlock": "10.0.32.0/20", "MapPublicIpOnLaunch": false, "Tags": [ { "Key": "aws-cdk:subnet-name", "Value": "app" }, { "Key": "aws-cdk:subnet-type", "Value": "Private" }, { "Key": "brainbase-appliance", "Value": "v1" }, { "Key": "Name", "Value": "BrainbaseAppliance/Network/Vpc/appSubnet2" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/appSubnet2/Subnet" } }, "NetworkVpcappSubnet2RouteTable1D6B4B37": { "Type": "AWS::EC2::RouteTable", "Properties": { "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" }, { "Key": "Name", "Value": "BrainbaseAppliance/Network/Vpc/appSubnet2" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/appSubnet2/RouteTable" } }, "NetworkVpcappSubnet2RouteTableAssociationAB6CD379": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "RouteTableId": { "Ref": "NetworkVpcappSubnet2RouteTable1D6B4B37" }, "SubnetId": { "Ref": "NetworkVpcappSubnet2SubnetC46F4198" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/appSubnet2/RouteTableAssociation" } }, "NetworkVpcappSubnet2DefaultRoute5CF349B1": { "Type": "AWS::EC2::Route", "Properties": { "DestinationCidrBlock": "0.0.0.0/0", "NatGatewayId": { "Ref": "NetworkVpcpublicSubnet1NATGateway939C8F7E" }, "RouteTableId": { "Ref": "NetworkVpcappSubnet2RouteTable1D6B4B37" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/appSubnet2/DefaultRoute" } }, "NetworkVpcIGW6BEA7B02": { "Type": "AWS::EC2::InternetGateway", "Properties": { "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" }, { "Key": "Name", "Value": "bb-appliance-vpc" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/IGW" } }, "NetworkVpcVPCGW8F3799B5": { "Type": "AWS::EC2::VPCGatewayAttachment", "Properties": { "InternetGatewayId": { "Ref": "NetworkVpcIGW6BEA7B02" }, "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Network/Vpc/VPCGW" } }, "EdgeAlb09518372": { "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", "Properties": { "LoadBalancerAttributes": [ { "Key": "deletion_protection.enabled", "Value": "false" } ], "Name": "bb-appliance-alb", "Scheme": "internet-facing", "SecurityGroups": [ { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] } ], "Subnets": [ { "Ref": "NetworkVpcpublicSubnet1Subnet00617657" }, { "Ref": "NetworkVpcpublicSubnet2SubnetDCAA7C9A" } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Type": "application" }, "DependsOn": [ "NetworkVpcpublicSubnet1DefaultRoute19622567", "NetworkVpcpublicSubnet1RouteTableAssociation203B743E", "NetworkVpcpublicSubnet2DefaultRouteF6C22611", "NetworkVpcpublicSubnet2RouteTableAssociationA4B52C34" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/Resource" } }, "EdgeAlbSecurityGroup529778D4": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "Automatically created Security Group for ELB BrainbaseApplianceEdgeAlb4B9AF93E", "SecurityGroupIngress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow from anyone on port 443", "FromPort": 443, "IpProtocol": "tcp", "ToPort": 443 }, { "CidrIp": "0.0.0.0/0", "Description": "Allow from anyone on port 80", "FromPort": 80, "IpProtocol": "tcp", "ToPort": 80 } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/SecurityGroup/Resource" } }, "EdgeAlbSecurityGrouptoBrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE8680001FD058D7": { "Type": "AWS::EC2::SecurityGroupEgress", "Properties": { "Description": "Load balancer to target", "DestinationSecurityGroupId": { "Fn::GetAtt": [ "SupabaseServicesKongServiceSecurityGroupB4255BEF", "GroupId" ] }, "FromPort": 8000, "GroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "IpProtocol": "tcp", "ToPort": 8000 }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/SecurityGroup/to BrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE86:8000" } }, "EdgeAlbSecurityGrouptoBrainbaseApplianceLlmServiceSecurityGroup2D05FF02808086525D95": { "Type": "AWS::EC2::SecurityGroupEgress", "Properties": { "Description": "Load balancer to target", "DestinationSecurityGroupId": { "Fn::GetAtt": [ "LlmServiceSecurityGroup0146E616", "GroupId" ] }, "FromPort": 8080, "GroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "IpProtocol": "tcp", "ToPort": 8080 }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/SecurityGroup/to BrainbaseApplianceLlmServiceSecurityGroup2D05FF02:8080" } }, "EdgeAlbSecurityGrouptoBrainbaseApplianceMcpsOrchestrationServiceSecurityGroup22C9282887772834632E": { "Type": "AWS::EC2::SecurityGroupEgress", "Properties": { "Description": "Load balancer to target", "DestinationSecurityGroupId": { "Fn::GetAtt": [ "McpsOrchestrationServiceSecurityGroup47C00585", "GroupId" ] }, "FromPort": 8777, "GroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "IpProtocol": "tcp", "ToPort": 8777 }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/SecurityGroup/to BrainbaseApplianceMcpsOrchestrationServiceSecurityGroup22C92828:8777" } }, "EdgeAlbSecurityGrouptoBrainbaseApplianceMcpsGithubServiceSecurityGroupAD1F375D87780A976E9E": { "Type": "AWS::EC2::SecurityGroupEgress", "Properties": { "Description": "Load balancer to target", "DestinationSecurityGroupId": { "Fn::GetAtt": [ "McpsGithubServiceSecurityGroup0DE447E1", "GroupId" ] }, "FromPort": 8778, "GroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "IpProtocol": "tcp", "ToPort": 8778 }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/SecurityGroup/to BrainbaseApplianceMcpsGithubServiceSecurityGroupAD1F375D:8778" } }, "EdgeAlbSecurityGrouptoBrainbaseApplianceMcpsSlackServiceSecurityGroup107917C78777EA6FD105": { "Type": "AWS::EC2::SecurityGroupEgress", "Properties": { "Description": "Load balancer to target", "DestinationSecurityGroupId": { "Fn::GetAtt": [ "McpsSlackServiceSecurityGroupA0EB7CCB", "GroupId" ] }, "FromPort": 8777, "GroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "IpProtocol": "tcp", "ToPort": 8777 }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/SecurityGroup/to BrainbaseApplianceMcpsSlackServiceSecurityGroup107917C7:8777" } }, "EdgeAlbSecurityGrouptoBrainbaseApplianceMcpsProxyServiceSecurityGroup3367FF0B8777B2A33CE4": { "Type": "AWS::EC2::SecurityGroupEgress", "Properties": { "Description": "Load balancer to target", "DestinationSecurityGroupId": { "Fn::GetAtt": [ "McpsProxyServiceSecurityGroupCAF3D757", "GroupId" ] }, "FromPort": 8777, "GroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "IpProtocol": "tcp", "ToPort": 8777 }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/SecurityGroup/to BrainbaseApplianceMcpsProxyServiceSecurityGroup3367FF0B:8777" } }, "EdgeAlbSecurityGrouptoBrainbaseApplianceMasWebServiceSecurityGroup0AA92824800091A3A48E": { "Type": "AWS::EC2::SecurityGroupEgress", "Properties": { "Description": "Load balancer to target", "DestinationSecurityGroupId": { "Fn::GetAtt": [ "MasWebServiceSecurityGroupC910FFF6", "GroupId" ] }, "FromPort": 8000, "GroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "IpProtocol": "tcp", "ToPort": 8000 }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/SecurityGroup/to BrainbaseApplianceMasWebServiceSecurityGroup0AA92824:8000" } }, "EdgeAlbSecurityGrouptoBrainbaseApplianceConnectorsServiceSecurityGroup82F5768D3000EF372469": { "Type": "AWS::EC2::SecurityGroupEgress", "Properties": { "Description": "Load balancer to target", "DestinationSecurityGroupId": { "Fn::GetAtt": [ "ConnectorsServiceSecurityGroup83741966", "GroupId" ] }, "FromPort": 3000, "GroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "IpProtocol": "tcp", "ToPort": 3000 }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/SecurityGroup/to BrainbaseApplianceConnectorsServiceSecurityGroup82F5768D:3000" } }, "EdgeAlbSecurityGrouptoBrainbaseApplianceClientServiceSecurityGroupEFE01CC13000FFE01115": { "Type": "AWS::EC2::SecurityGroupEgress", "Properties": { "Description": "Load balancer to target", "DestinationSecurityGroupId": { "Fn::GetAtt": [ "ClientServiceSecurityGroup0E2FD644", "GroupId" ] }, "FromPort": 3000, "GroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "IpProtocol": "tcp", "ToPort": 3000 }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/SecurityGroup/to BrainbaseApplianceClientServiceSecurityGroupEFE01CC1:3000" } }, "EdgeAlbHttps549ABF6F": { "Type": "AWS::ElasticLoadBalancingV2::Listener", "Properties": { "Certificates": [ { "CertificateArn": { "Ref": "EdgeCertD469F9D2" } } ], "DefaultActions": [ { "FixedResponseConfig": { "ContentType": "text/plain", "MessageBody": "no route", "StatusCode": "503" }, "Type": "fixed-response" } ], "LoadBalancerArn": { "Ref": "EdgeAlb09518372" }, "Port": 443, "Protocol": "HTTPS", "SslPolicy": "ELBSecurityPolicy-TLS13-1-2-2021-06", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/Https/Resource" } }, "EdgeAlbHttpsWildcardCert195309778": { "Type": "AWS::ElasticLoadBalancingV2::ListenerCertificate", "Properties": { "Certificates": [ { "CertificateArn": { "Ref": "EdgeWildcardCert8E488069" } } ], "ListenerArn": { "Ref": "EdgeAlbHttps549ABF6F" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/Https/WildcardCert1/Resource" } }, "EdgeAlbHttpskongRuleRule91266FBC": { "Type": "AWS::ElasticLoadBalancingV2::ListenerRule", "Properties": { "Actions": [ { "TargetGroupArn": { "Ref": "SupabaseServicesKongTg01DBFBE7" }, "Type": "forward" } ], "Conditions": [ { "Field": "host-header", "HostHeaderConfig": { "Values": [ { "Fn::Join": [ "", [ "supabase.", { "Ref": "DomainName" } ] ] } ] } } ], "ListenerArn": { "Ref": "EdgeAlbHttps549ABF6F" }, "Priority": 60, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/Https/kongRuleRule/Resource" } }, "EdgeAlbHttpsllmRuleRule7A1BC9FB": { "Type": "AWS::ElasticLoadBalancingV2::ListenerRule", "Properties": { "Actions": [ { "TargetGroupArn": { "Ref": "LlmServiceTgB268E376" }, "Type": "forward" } ], "Conditions": [ { "Field": "host-header", "HostHeaderConfig": { "Values": [ { "Fn::Join": [ "", [ "llm.", { "Ref": "DomainName" } ] ] } ] } } ], "ListenerArn": { "Ref": "EdgeAlbHttps549ABF6F" }, "Priority": 70, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/Https/llmRuleRule/Resource" } }, "EdgeAlbHttpsorchestrationRuleRule3E300176": { "Type": "AWS::ElasticLoadBalancingV2::ListenerRule", "Properties": { "Actions": [ { "TargetGroupArn": { "Ref": "McpsOrchestrationTgAD39B9C3" }, "Type": "forward" } ], "Conditions": [ { "Field": "host-header", "HostHeaderConfig": { "Values": [ { "Fn::Join": [ "", [ "orchestration.", { "Ref": "DomainName" } ] ] } ] } } ], "ListenerArn": { "Ref": "EdgeAlbHttps549ABF6F" }, "Priority": 80, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/Https/orchestrationRuleRule/Resource" } }, "EdgeAlbHttpsgithubRuleRuleBE127F5F": { "Type": "AWS::ElasticLoadBalancingV2::ListenerRule", "Properties": { "Actions": [ { "TargetGroupArn": { "Ref": "McpsGithubTg3B03757B" }, "Type": "forward" } ], "Conditions": [ { "Field": "host-header", "HostHeaderConfig": { "Values": [ { "Fn::Join": [ "", [ "github.", { "Ref": "DomainName" } ] ] } ] } } ], "ListenerArn": { "Ref": "EdgeAlbHttps549ABF6F" }, "Priority": 81, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/Https/githubRuleRule/Resource" } }, "EdgeAlbHttpsslackRuleRuleAB98A3F1": { "Type": "AWS::ElasticLoadBalancingV2::ListenerRule", "Properties": { "Actions": [ { "TargetGroupArn": { "Ref": "McpsSlackTgC65FACB6" }, "Type": "forward" } ], "Conditions": [ { "Field": "host-header", "HostHeaderConfig": { "Values": [ { "Fn::Join": [ "", [ "slack.", { "Ref": "DomainName" } ] ] } ] } } ], "ListenerArn": { "Ref": "EdgeAlbHttps549ABF6F" }, "Priority": 82, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/Https/slackRuleRule/Resource" } }, "EdgeAlbHttpsproxyRuleRule7A63DFE1": { "Type": "AWS::ElasticLoadBalancingV2::ListenerRule", "Properties": { "Actions": [ { "TargetGroupArn": { "Ref": "McpsProxyTgF7EFDE6A" }, "Type": "forward" } ], "Conditions": [ { "Field": "host-header", "HostHeaderConfig": { "Values": [ { "Fn::Join": [ "", [ "proxy.", { "Ref": "DomainName" } ] ] } ] } } ], "ListenerArn": { "Ref": "EdgeAlbHttps549ABF6F" }, "Priority": 83, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/Https/proxyRuleRule/Resource" } }, "EdgeAlbHttpsmaswebRuleRule2EF71D65": { "Type": "AWS::ElasticLoadBalancingV2::ListenerRule", "Properties": { "Actions": [ { "TargetGroupArn": { "Ref": "MasWebTgDEF6F588" }, "Type": "forward" } ], "Conditions": [ { "Field": "host-header", "HostHeaderConfig": { "Values": [ { "Fn::Join": [ "", [ "api.", { "Ref": "DomainName" } ] ] } ] } } ], "ListenerArn": { "Ref": "EdgeAlbHttps549ABF6F" }, "Priority": 90, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/Https/mas-webRuleRule/Resource" } }, "EdgeAlbHttpsMasDocsDenyRuleBCB960A3": { "Type": "AWS::ElasticLoadBalancingV2::ListenerRule", "Properties": { "Actions": [ { "FixedResponseConfig": { "ContentType": "text/plain", "MessageBody": "not found", "StatusCode": "404" }, "Type": "fixed-response" } ], "Conditions": [ { "Field": "path-pattern", "PathPatternConfig": { "Values": [ "/docs", "/docs/*", "/openapi.json" ] } }, { "Field": "host-header", "HostHeaderConfig": { "Values": [ { "Fn::Join": [ "", [ "api.", { "Ref": "DomainName" } ] ] } ] } } ], "ListenerArn": { "Ref": "EdgeAlbHttps549ABF6F" }, "Priority": 15, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/Https/MasDocsDenyRule/Resource" } }, "EdgeAlbHttpsMasRedocDenyRule501EF5C2": { "Type": "AWS::ElasticLoadBalancingV2::ListenerRule", "Properties": { "Actions": [ { "FixedResponseConfig": { "ContentType": "text/plain", "MessageBody": "not found", "StatusCode": "404" }, "Type": "fixed-response" } ], "Conditions": [ { "Field": "path-pattern", "PathPatternConfig": { "Values": [ "/redoc", "/redoc/*" ] } }, { "Field": "host-header", "HostHeaderConfig": { "Values": [ { "Fn::Join": [ "", [ "api.", { "Ref": "DomainName" } ] ] } ] } } ], "ListenerArn": { "Ref": "EdgeAlbHttps549ABF6F" }, "Priority": 16, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/Https/MasRedocDenyRule/Resource" } }, "EdgeAlbHttpsconnectorsRuleRule920D4FF8": { "Type": "AWS::ElasticLoadBalancingV2::ListenerRule", "Properties": { "Actions": [ { "TargetGroupArn": { "Ref": "ConnectorsServiceTg227875E2" }, "Type": "forward" } ], "Conditions": [ { "Field": "host-header", "HostHeaderConfig": { "Values": [ { "Fn::Join": [ "", [ "hooks.", { "Ref": "DomainName" } ] ] } ] } } ], "ListenerArn": { "Ref": "EdgeAlbHttps549ABF6F" }, "Priority": 91, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/Https/connectorsRuleRule/Resource" } }, "EdgeAlbHttpsclientRuleRule5A92A289": { "Type": "AWS::ElasticLoadBalancingV2::ListenerRule", "Properties": { "Actions": [ { "TargetGroupArn": { "Ref": "ClientServiceTgB9C17B78" }, "Type": "forward" } ], "Conditions": [ { "Field": "host-header", "HostHeaderConfig": { "Values": [ { "Fn::Join": [ "", [ "app.", { "Ref": "DomainName" } ] ] } ] } } ], "ListenerArn": { "Ref": "EdgeAlbHttps549ABF6F" }, "Priority": 92, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/Https/clientRuleRule/Resource" } }, "EdgeAlbHttp5EE28CB9": { "Type": "AWS::ElasticLoadBalancingV2::Listener", "Properties": { "DefaultActions": [ { "RedirectConfig": { "Port": "443", "Protocol": "HTTPS", "StatusCode": "HTTP_301" }, "Type": "redirect" } ], "LoadBalancerArn": { "Ref": "EdgeAlb09518372" }, "Port": 80, "Protocol": "HTTP", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Alb/Http/Resource" } }, "EdgeCertD469F9D2": { "Type": "AWS::CertificateManager::Certificate", "Properties": { "DomainName": { "Ref": "DomainName" }, "DomainValidationOptions": [ { "DomainName": { "Ref": "DomainName" }, "HostedZoneId": { "Ref": "HostedZoneId" } } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" }, { "Key": "Name", "Value": "BrainbaseAppliance/Edge/Cert" } ], "ValidationMethod": "DNS" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/Cert/Resource" } }, "EdgeWildcardCert8E488069": { "Type": "AWS::CertificateManager::Certificate", "Properties": { "DomainName": { "Fn::Join": [ "", [ "*.", { "Ref": "DomainName" } ] ] }, "DomainValidationOptions": [ { "DomainName": { "Fn::Join": [ "", [ "*.", { "Ref": "DomainName" } ] ] }, "HostedZoneId": { "Ref": "HostedZoneId" } } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" }, { "Key": "Name", "Value": "BrainbaseAppliance/Edge/WildcardCert" } ], "ValidationMethod": "DNS" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/WildcardCert/Resource" } }, "EdgeAppAliasA91014C0B": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "app.", { "Ref": "DomainName" }, "." ] ] }, "Type": "A" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/AppAliasA/Resource" } }, "EdgeAppAliasAAAADA7A2FFA": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "app.", { "Ref": "DomainName" }, "." ] ] }, "Type": "AAAA" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/AppAliasAAAA/Resource" } }, "EdgeApiAliasAEACDCE39": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "api.", { "Ref": "DomainName" }, "." ] ] }, "Type": "A" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/ApiAliasA/Resource" } }, "EdgeApiAliasAAAAEA3F5985": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "api.", { "Ref": "DomainName" }, "." ] ] }, "Type": "AAAA" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/ApiAliasAAAA/Resource" } }, "EdgeLlmAliasADD02DF27": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "llm.", { "Ref": "DomainName" }, "." ] ] }, "Type": "A" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/LlmAliasA/Resource" } }, "EdgeLlmAliasAAAAA43A33AD": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "llm.", { "Ref": "DomainName" }, "." ] ] }, "Type": "AAAA" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/LlmAliasAAAA/Resource" } }, "EdgeHooksAliasAAD94108D": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "hooks.", { "Ref": "DomainName" }, "." ] ] }, "Type": "A" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/HooksAliasA/Resource" } }, "EdgeHooksAliasAAAA10F45B5F": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "hooks.", { "Ref": "DomainName" }, "." ] ] }, "Type": "AAAA" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/HooksAliasAAAA/Resource" } }, "EdgeSupabaseAliasA5201A8A6": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "supabase.", { "Ref": "DomainName" }, "." ] ] }, "Type": "A" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/SupabaseAliasA/Resource" } }, "EdgeSupabaseAliasAAAA4AF9A3B2": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "supabase.", { "Ref": "DomainName" }, "." ] ] }, "Type": "AAAA" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/SupabaseAliasAAAA/Resource" } }, "EdgeOrchestrationAliasA5829B733": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "orchestration.", { "Ref": "DomainName" }, "." ] ] }, "Type": "A" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/OrchestrationAliasA/Resource" } }, "EdgeOrchestrationAliasAAAAB4B4F102": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "orchestration.", { "Ref": "DomainName" }, "." ] ] }, "Type": "AAAA" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/OrchestrationAliasAAAA/Resource" } }, "EdgeGithubAliasADFF0E115": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "github.", { "Ref": "DomainName" }, "." ] ] }, "Type": "A" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/GithubAliasA/Resource" } }, "EdgeGithubAliasAAAA3BF6AFD7": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "github.", { "Ref": "DomainName" }, "." ] ] }, "Type": "AAAA" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/GithubAliasAAAA/Resource" } }, "EdgeSlackAliasA54C687F5": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "slack.", { "Ref": "DomainName" }, "." ] ] }, "Type": "A" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/SlackAliasA/Resource" } }, "EdgeSlackAliasAAAA08B5E8D4": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "slack.", { "Ref": "DomainName" }, "." ] ] }, "Type": "AAAA" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/SlackAliasAAAA/Resource" } }, "EdgeProxyAliasA28FB1376": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "proxy.", { "Ref": "DomainName" }, "." ] ] }, "Type": "A" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/ProxyAliasA/Resource" } }, "EdgeProxyAliasAAAAB1B7A5D0": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "proxy.", { "Ref": "DomainName" }, "." ] ] }, "Type": "AAAA" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/ProxyAliasAAAA/Resource" } }, "EdgeLinearAliasA2EF01395": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "linear.", { "Ref": "DomainName" }, "." ] ] }, "Type": "A" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/LinearAliasA/Resource" } }, "EdgeLinearAliasAAAAAB73D301": { "Type": "AWS::Route53::RecordSet", "Properties": { "AliasTarget": { "DNSName": { "Fn::Join": [ "", [ "dualstack.", { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } ] ] }, "HostedZoneId": { "Fn::GetAtt": [ "EdgeAlb09518372", "CanonicalHostedZoneID" ] } }, "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::Join": [ "", [ "linear.", { "Ref": "DomainName" }, "." ] ] }, "Type": "AAAA" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Edge/LinearAliasAAAA/Resource" } }, "EcsServiceLinkedRoleReadyHandlerRoleAFDEDB8E": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "iam:GetRole", "iam:ListAttachedRolePolicies" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS" ] ] } }, { "Action": "iam:CreateServiceLinkedRole", "Condition": { "StringEquals": { "iam:AWSServiceName": "ecs.amazonaws.com" } }, "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "EcsServiceLinkedRoleReadiness" } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/EcsServiceLinkedRoleReady/HandlerRole/Resource" } }, "EcsServiceLinkedRoleReadyHandlerDE8F05DB": { "Type": "AWS::Lambda::Function", "Properties": { "Architectures": [ "arm64" ], "Code": { "ZipFile": "\"use strict\";\nconst https = require(\"https\");\nconst send = (url, body) => new Promise((resolve, reject) => {\n const payload = JSON.stringify(body); const u = new URL(url);\n const req = https.request({ hostname: u.hostname, path: u.pathname + u.search, method: \"PUT\",\n headers: { \"content-type\": \"\", \"content-length\": Buffer.byteLength(payload) } }, (res) => {\n res.resume(); res.on(\"end\", () => (res.statusCode < 300 ? resolve() : reject(new Error(\"response \" + res.statusCode))));\n });\n req.on(\"error\", reject); req.end(payload);\n});\nconst reply = (e, pid, Status, Reason) => send(e.ResponseURL, { Status, Reason, StackId: e.StackId,\n RequestId: e.RequestId, LogicalResourceId: e.LogicalResourceId, PhysicalResourceId: pid,\n NoEcho: false, Data: {} });\nconst sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));\nconst missing = (e) => e && (e.name === \"NoSuchEntity\" || e.name === \"NoSuchEntityException\");\nconst duplicate = (e) => e && /^InvalidInput/.test(e.name || \"\") && /taken|already exists/i.test(e.message || \"\");\nexports.handler = async (e) => {\n const pid = e.PhysicalResourceId || process.env.PHYSICAL_ID;\n if (e.RequestType === \"Delete\") { await reply(e, pid, \"SUCCESS\", \"account-wide role retained\"); return; }\n try {\n const { IAMClient, GetRoleCommand, CreateServiceLinkedRoleCommand, ListAttachedRolePoliciesCommand } = require(\"@aws-sdk/client-iam\");\n const client = new IAMClient({}); const role = \"AWSServiceRoleForECS\";\n let fresh = false;\n try { await client.send(new GetRoleCommand({ RoleName: role })); }\n catch (err) {\n if (!missing(err)) throw err;\n fresh = true;\n try { await client.send(new CreateServiceLinkedRoleCommand({ AWSServiceName: \"ecs.amazonaws.com\",\n Description: \"Allows Amazon ECS to manage appliance cluster resources.\" })); }\n catch (createErr) { if (!duplicate(createErr)) throw createErr; }\n }\n let needsSettle = fresh;\n for (let attempt = 0; attempt < 30; attempt += 1) {\n try {\n if (fresh || attempt > 0) await client.send(new GetRoleCommand({ RoleName: role }));\n const result = await client.send(new ListAttachedRolePoliciesCommand({ RoleName: role }));\n if ((result.AttachedPolicies || []).some((p) => p.PolicyArn === \"arn:aws:iam::aws:policy/aws-service-role/AmazonECSServiceRolePolicy\")) {\n if (needsSettle) await sleep(30000);\n await reply(e, pid, \"SUCCESS\", fresh ? \"ECS service-linked role created and stabilized\" : \"ECS service-linked role already ready\");\n return;\n }\n needsSettle = true;\n } catch (err) { if (!missing(err)) throw err; needsSettle = true; }\n if (attempt < 29) await sleep(2000);\n }\n throw new Error(\"AWSServiceRoleForECS did not become ready within 60 seconds\");\n } catch (err) {\n await reply(e, pid, \"FAILED\", \"ECS service-linked role readiness failed: \" + String((err && err.message) || err));\n }\n};\n" }, "Description": "bb-appliance: wait for the account-wide Amazon ECS service-linked role before creating the Service Connect cluster", "Environment": { "Variables": { "PHYSICAL_ID": "ecs-service-linked-role/ecs.amazonaws.com" } }, "Handler": "index.handler", "MemorySize": 128, "Role": { "Fn::GetAtt": [ "EcsServiceLinkedRoleReadyHandlerRoleAFDEDB8E", "Arn" ] }, "Runtime": "nodejs22.x", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Timeout": 150 }, "DependsOn": [ "EcsServiceLinkedRoleReadyHandlerRoleAFDEDB8E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/EcsServiceLinkedRoleReady/Handler/Resource" } }, "EcsServiceLinkedRoleReadyHandlerEventInvokeConfig47190DF7": { "Type": "AWS::Lambda::EventInvokeConfig", "Properties": { "FunctionName": { "Ref": "EcsServiceLinkedRoleReadyHandlerDE8F05DB" }, "MaximumRetryAttempts": 0, "Qualifier": "$LATEST" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/EcsServiceLinkedRoleReady/Handler/EventInvokeConfig/Resource" } }, "EcsServiceLinkedRoleReady361D0F9A": { "Type": "Custom::EcsServiceLinkedRoleReady", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "EcsServiceLinkedRoleReadyHandlerDE8F05DB", "Arn" ] }, "ServiceTimeout": "180" }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/EcsServiceLinkedRoleReady/Resource/Default" } }, "ClusterEB0386A7": { "Type": "AWS::ECS::Cluster", "Properties": { "ClusterName": "bb-appliance", "ClusterSettings": [ { "Name": "containerInsights", "Value": "enabled" } ], "ServiceConnectDefaults": { "Namespace": { "Fn::GetAtt": [ "ClusterDefaultServiceDiscoveryNamespaceC336F9B4", "Arn" ] } }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "EcsServiceLinkedRoleReady361D0F9A" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Cluster/Resource" } }, "ClusterDefaultServiceDiscoveryNamespaceC336F9B4": { "Type": "AWS::ServiceDiscovery::PrivateDnsNamespace", "Properties": { "Name": "bb-appliance.local", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Vpc": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "EcsServiceLinkedRoleReady361D0F9A" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Cluster/DefaultServiceDiscoveryNamespace/Resource" } }, "LambdaImageCloneRepositoryE1F8FF7B": { "Type": "AWS::ECR::Repository", "Properties": { "EmptyOnDelete": true, "ImageScanningConfiguration": { "ScanOnPush": false }, "ImageTagMutability": "IMMUTABLE", "LifecyclePolicy": { "LifecyclePolicyText": "{\"rules\":[{\"rulePriority\":1,\"description\":\"expire untagged layers/manifests after a day\",\"selection\":{\"tagStatus\":\"untagged\",\"countType\":\"sinceImagePushed\",\"countUnit\":\"days\",\"countNumber\":1},\"action\":{\"type\":\"expire\"}}]}" }, "RepositoryPolicyText": { "Statement": [ { "Action": [ "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer" ], "Condition": { "StringLike": { "aws:sourceArn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":lambda:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":function:*" ] ] } } }, "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" }, "Sid": "LambdaECRImageRetrievalPolicy" } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/LambdaImageClone/Repository/Resource" } }, "LambdaImageCloneProjectRole28D2A3B7": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "codebuild.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/LambdaImageClone/Project/Role/Resource" } }, "LambdaImageCloneProjectRoleDefaultPolicy2D40E217": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/codebuild/", { "Ref": "LambdaImageCloneProjectD9B40549" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/codebuild/", { "Ref": "LambdaImageCloneProjectD9B40549" }, ":*" ] ] } ] }, { "Action": [ "codebuild:CreateReportGroup", "codebuild:CreateReport", "codebuild:UpdateReport", "codebuild:BatchPutTestCases", "codebuild:BatchPutCodeCoverages" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":codebuild:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":report-group/", { "Ref": "LambdaImageCloneProjectD9B40549" }, "-*" ] ] } }, { "Action": "ecr:GetAuthorizationToken", "Effect": "Allow", "Resource": "*" }, { "Action": [ "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ecr:InitiateLayerUpload", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload", "ecr:PutImage", "ecr:DescribeImages" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaImageCloneProjectRoleDefaultPolicy2D40E217", "Roles": [ { "Ref": "LambdaImageCloneProjectRole28D2A3B7" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/LambdaImageClone/Project/Role/DefaultPolicy/Resource" } }, "LambdaImageCloneProjectD9B40549": { "Type": "AWS::CodeBuild::Project", "Properties": { "Artifacts": { "Type": "NO_ARTIFACTS" }, "Cache": { "Type": "NO_CACHE" }, "Description": "bb-appliance: clone lambda-utils from AWS Marketplace ECR into this account (Lambda cannot pull Marketplace images directly)", "EncryptionKey": "alias/aws/s3", "Environment": { "ComputeType": "BUILD_GENERAL1_SMALL", "EnvironmentVariables": [ { "Name": "SOURCE_IMAGE", "Type": "PLAINTEXT", "Value": "709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-lambda-utils:ctx-611d7c08fc25" }, { "Name": "DEST_REPOSITORY", "Type": "PLAINTEXT", "Value": { "Fn::Join": [ "", [ { "Fn::Select": [ 4, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".dkr.ecr.", { "Fn::Select": [ 3, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".", { "Ref": "AWS::URLSuffix" }, "/", { "Ref": "LambdaImageCloneRepositoryE1F8FF7B" } ] ] } }, { "Name": "CRANE_VERSION", "Type": "PLAINTEXT", "Value": "v0.22.0" }, { "Name": "CRANE_SHA256_ARM64", "Type": "PLAINTEXT", "Value": "971e8e2de7e09172330527a9dfb10689e344b160fd81bac7fb91adcb109bad37" } ], "Image": "aws/codebuild/amazonlinux-aarch64-standard:3.0", "ImagePullCredentialsType": "CODEBUILD", "PrivilegedMode": false, "Type": "ARM_CONTAINER" }, "ServiceRole": { "Fn::GetAtt": [ "LambdaImageCloneProjectRole28D2A3B7", "Arn" ] }, "Source": { "BuildSpec": "{\n \"version\": \"0.2\",\n \"env\": {\n \"shell\": \"bash\"\n },\n \"phases\": {\n \"build\": {\n \"commands\": [\n \"bash <<'BB_CLONE_SCRIPT'\\nset -euo pipefail\\nstatus=\\\"FAILED\\\"\\nreason=\\\"the clone did not start\\\"\\ndigest=\\\"\\\"\\nrespond() {\\n local data safe body\\n if [ \\\"$status\\\" = \\\"SUCCESS\\\" ]; then\\n data=$(printf '{\\\"ImageDigest\\\":\\\"%s\\\",\\\"ImageDigestHex\\\":\\\"%s\\\",\\\"ImageUri\\\":\\\"%s\\\"}' \\\"$digest\\\" \\\"${digest#sha256:}\\\" \\\"${DEST_REPOSITORY:-}@${digest}\\\")\\n else\\n data='{}'\\n fi\\n safe=$(printf '%s' \\\"$reason\\\" | tr -d '\\\"\\\\\\\\' | LC_ALL=C tr -d '\\\\000-\\\\037\\\\177' | cut -c1-900)\\n body=$(printf '{\\\"Status\\\":\\\"%s\\\",\\\"Reason\\\":\\\"%s\\\",\\\"StackId\\\":\\\"%s\\\",\\\"RequestId\\\":\\\"%s\\\",\\\"LogicalResourceId\\\":\\\"%s\\\",\\\"PhysicalResourceId\\\":\\\"%s\\\",\\\"NoEcho\\\":false,\\\"Data\\\":%s}' \\\\\\n \\\"$status\\\" \\\"$safe\\\" \\\"${STACK_ID:-}\\\" \\\"${REQUEST_ID:-}\\\" \\\"${LOGICAL_RESOURCE_ID:-}\\\" \\\"${PHYSICAL_RESOURCE_ID:-}\\\" \\\"$data\\\")\\n curl -sS -f -X PUT -H 'Content-Type;' --retry 5 --retry-all-errors --max-time 30 --data-binary \\\"$body\\\" \\\"${RESPONSE_URL:-}\\\" >/dev/null \\\\\\n || echo \\\"WARNING: could not deliver the CloudFormation response ($status)\\\" >&2\\n echo \\\"clone: $status — $reason\\\"\\n}\\ntrap respond EXIT\\nfail() { reason=\\\"$1\\\"; echo \\\"ERROR: $1\\\" >&2; exit 1; }\\nfor v in SOURCE_IMAGE DEST_REPOSITORY CRANE_VERSION CRANE_SHA256_ARM64 RESPONSE_URL STACK_ID REQUEST_ID LOGICAL_RESOURCE_ID PHYSICAL_RESOURCE_ID AWS_REGION; do\\n [ -n \\\"${!v:-}\\\" ] || fail \\\"required variable $v is empty\\\"\\ndone\\nTAG=\\\"${SOURCE_IMAGE##*:}\\\"\\nSRC_HOST=\\\"${SOURCE_IMAGE%%/*}\\\"\\nDEST_HOST=\\\"${DEST_REPOSITORY%%/*}\\\"\\nDEST_REPO_NAME=\\\"${DEST_REPOSITORY#*/}\\\"\\nwork=$(mktemp -d \\\"${TMPDIR:-/tmp}/bb-clone.XXXXXX\\\") || fail \\\"could not create a work directory\\\"\\nexport DOCKER_CONFIG=\\\"$work/.docker\\\"\\ncurl -sSfL --retry 3 -o \\\"$work/crane.tgz\\\" \\\"https://github.com/google/go-containerregistry/releases/download/$CRANE_VERSION/go-containerregistry_Linux_arm64.tar.gz\\\" \\\\\\n || fail \\\"could not download crane $CRANE_VERSION (this build needs HTTPS egress to github.com)\\\"\\necho \\\"$CRANE_SHA256_ARM64 $work/crane.tgz\\\" | sha256sum -c - >/dev/null 2>&1 \\\\\\n || fail \\\"crane tarball sha256 mismatch (expected $CRANE_SHA256_ARM64)\\\"\\ntar -xzf \\\"$work/crane.tgz\\\" -C \\\"$work\\\" crane || fail \\\"could not extract crane from the tarball\\\"\\nCRANE=\\\"$work/crane\\\"\\naws ecr get-login-password --region \\\"$AWS_REGION\\\" | \\\"$CRANE\\\" auth login \\\"$SRC_HOST\\\" -u AWS --password-stdin \\\\\\n || fail \\\"could not log in to the source registry $SRC_HOST\\\"\\naws ecr get-login-password --region \\\"$AWS_REGION\\\" | \\\"$CRANE\\\" auth login \\\"$DEST_HOST\\\" -u AWS --password-stdin \\\\\\n || fail \\\"could not log in to the destination registry $DEST_HOST\\\"\\nexpected=$(\\\"$CRANE\\\" digest \\\"$SOURCE_IMAGE\\\") \\\\\\n || fail \\\"cannot read the source image $SOURCE_IMAGE (is this account subscribed to the product, and is the tag published?)\\\"\\nset +e\\nhave=$(aws ecr describe-images --region \\\"$AWS_REGION\\\" --repository-name \\\"$DEST_REPO_NAME\\\" \\\\\\n --image-ids \\\"imageTag=$TAG\\\" --query 'imageDetails[0].imageDigest' --output text 2>\\\"$work/probe.err\\\")\\ncode=$?\\nset -e\\nif [ \\\"$code\\\" -ne 0 ]; then\\n grep -qF '(ImageNotFoundException)' \\\"$work/probe.err\\\" || fail \\\"probe of $DEST_REPOSITORY:$TAG failed (not 'absent'): $(tr '\\\\n' ' ' <\\\"$work/probe.err\\\")\\\"\\n have=\\\"\\\"\\nfi\\ncase \\\"$have\\\" in\\n \\\"\\\"|None)\\n \\\"$CRANE\\\" copy \\\"$SOURCE_IMAGE\\\" \\\"$DEST_REPOSITORY:$TAG\\\" || fail \\\"crane copy $SOURCE_IMAGE -> $DEST_REPOSITORY:$TAG failed\\\" ;;\\n \\\"$expected\\\")\\n echo \\\"already present at $expected\\\" ;;\\n *)\\n fail \\\"destination $DEST_REPOSITORY:$TAG already holds $have while the source is $expected — refusing to overwrite a published tag\\\" ;;\\nesac\\nlanded=$(\\\"$CRANE\\\" digest \\\"$DEST_REPOSITORY:$TAG\\\") || fail \\\"cannot read back $DEST_REPOSITORY:$TAG after the copy\\\"\\n[ \\\"$landed\\\" = \\\"$expected\\\" ] || fail \\\"copy landed at $landed but the source is $expected — the clone is not byte-identical\\\"\\ndigest=\\\"$landed\\\"\\nstatus=\\\"SUCCESS\\\"\\nreason=\\\"cloned $SOURCE_IMAGE to $DEST_REPOSITORY:$TAG at $landed\\\"\\nBB_CLONE_SCRIPT\"\n ]\n }\n }\n}", "Type": "NO_SOURCE" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TimeoutInMinutes": 15 }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/LambdaImageClone/Project/Resource" } }, "LambdaImageCloneStarterServiceRoleACBAD815": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/LambdaImageClone/Starter/ServiceRole/Resource" } }, "LambdaImageCloneStarterServiceRoleDefaultPolicyB968BDC0": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "codebuild:StartBuild", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "LambdaImageCloneProjectD9B40549", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaImageCloneStarterServiceRoleDefaultPolicyB968BDC0", "Roles": [ { "Ref": "LambdaImageCloneStarterServiceRoleACBAD815" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/LambdaImageClone/Starter/ServiceRole/DefaultPolicy/Resource" } }, "LambdaImageCloneStarter48680956": { "Type": "AWS::Lambda::Function", "Properties": { "Architectures": [ "arm64" ], "Code": { "ZipFile": "\"use strict\";\nconst https = require(\"https\");\nconst send = (url, body) => new Promise((resolve, reject) => {\n const payload = JSON.stringify(body); const u = new URL(url);\n const req = https.request({ hostname: u.hostname, path: u.pathname + u.search, method: \"PUT\",\n headers: { \"content-type\": \"\", \"content-length\": Buffer.byteLength(payload) } }, (res) => {\n res.resume(); res.on(\"end\", () => (res.statusCode < 300 ? resolve() : reject(new Error(\"response \" + res.statusCode))));\n });\n req.on(\"error\", reject); req.end(payload);\n});\nconst reply = (e, pid, Status, Reason) => send(e.ResponseURL, { Status, Reason, StackId: e.StackId, RequestId: e.RequestId,\n LogicalResourceId: e.LogicalResourceId, PhysicalResourceId: pid, NoEcho: false, Data: {} });\nexports.handler = async (e) => {\n const pid = e.PhysicalResourceId || process.env.PHYSICAL_ID;\n if (e.RequestType === \"Delete\") { await reply(e, pid, \"SUCCESS\", \"nothing to delete: the repository empties itself\"); return; }\n const p = e.ResourceProperties || {};\n const v = (name, value) => ({ name, value: String(value), type: \"PLAINTEXT\" });\n try {\n // Required INSIDE the handler: a module-load failure must still reach the catch below and\n // answer FAILED, never leave CloudFormation waiting out ServiceTimeout.\n const { CodeBuildClient, StartBuildCommand } = require(\"@aws-sdk/client-codebuild\");\n await new CodeBuildClient({}).send(new StartBuildCommand({ projectName: process.env.PROJECT_NAME, environmentVariablesOverride: [\n v(\"SOURCE_IMAGE\", p.SourceImage), v(\"DEST_REPOSITORY\", p.DestinationRepository), v(\"CRANE_VERSION\", p.CraneVersion),\n v(\"CRANE_SHA256_ARM64\", p.CraneSha256Arm64), v(\"RESPONSE_URL\", e.ResponseURL), v(\"STACK_ID\", e.StackId), v(\"REQUEST_ID\", e.RequestId),\n v(\"LOGICAL_RESOURCE_ID\", e.LogicalResourceId), v(\"PHYSICAL_RESOURCE_ID\", pid)] }));\n } catch (err) {\n await reply(e, pid, \"FAILED\", \"StartBuild failed: \" + String((err && err.message) || err));\n }\n};\n" }, "Description": "bb-appliance: starts the lambda-utils clone build (Custom::LambdaImageClone)", "Environment": { "Variables": { "PROJECT_NAME": { "Ref": "LambdaImageCloneProjectD9B40549" }, "PHYSICAL_ID": "lambda-image-clone/lambda-utils" } }, "Handler": "index.handler", "MemorySize": 128, "Role": { "Fn::GetAtt": [ "LambdaImageCloneStarterServiceRoleACBAD815", "Arn" ] }, "Runtime": "nodejs22.x", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Timeout": 60 }, "DependsOn": [ "LambdaImageCloneStarterServiceRoleDefaultPolicyB968BDC0", "LambdaImageCloneStarterServiceRoleACBAD815" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/LambdaImageClone/Starter/Resource" } }, "LambdaImageCloneStarterEventInvokeConfigBA0A8464": { "Type": "AWS::Lambda::EventInvokeConfig", "Properties": { "FunctionName": { "Ref": "LambdaImageCloneStarter48680956" }, "MaximumRetryAttempts": 0, "Qualifier": "$LATEST" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/LambdaImageClone/Starter/EventInvokeConfig/Resource" } }, "LambdaImageClone2364B1C9": { "Type": "Custom::LambdaImageClone", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LambdaImageCloneStarter48680956", "Arn" ] }, "ServiceTimeout": "1500", "SourceImage": "709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-lambda-utils:ctx-611d7c08fc25", "DestinationRepository": { "Fn::Join": [ "", [ { "Fn::Select": [ 4, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".dkr.ecr.", { "Fn::Select": [ 3, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".", { "Ref": "AWS::URLSuffix" }, "/", { "Ref": "LambdaImageCloneRepositoryE1F8FF7B" } ] ] }, "CraneVersion": "v0.22.0", "CraneSha256Arm64": "971e8e2de7e09172330527a9dfb10689e344b160fd81bac7fb91adcb109bad37", "ReleaseVersion": "2026-09-16.1" }, "DependsOn": [ "LambdaImageCloneProjectD9B40549", "LambdaImageCloneProjectRoleDefaultPolicy2D40E217", "LambdaImageCloneProjectRole28D2A3B7" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/LambdaImageClone/Resource/Default" } }, "RestrictDefaultSgFnServiceRole84BA8496": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/RestrictDefaultSgFn/ServiceRole/Resource" } }, "RestrictDefaultSgFnServiceRoleDefaultPolicyC4488902": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ec2:RevokeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":security-group/", { "Fn::GetAtt": [ "NetworkVpc7FB7348F", "DefaultSecurityGroup" ] } ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "RestrictDefaultSgFnServiceRoleDefaultPolicyC4488902", "Roles": [ { "Ref": "RestrictDefaultSgFnServiceRole84BA8496" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/RestrictDefaultSgFn/ServiceRole/DefaultPolicy/Resource" } }, "RestrictDefaultSgFn9C75A0B7": { "Type": "AWS::Lambda::Function", "Properties": { "Architectures": [ "arm64" ], "Code": { "ImageUri": { "Fn::Join": [ "", [ { "Fn::Select": [ 4, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".dkr.ecr.", { "Fn::Select": [ 3, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".", { "Ref": "AWS::URLSuffix" }, "/", { "Ref": "LambdaImageCloneRepositoryE1F8FF7B" }, "@sha256:", { "Fn::GetAtt": [ "LambdaImageClone2364B1C9", "ImageDigestHex" ] } ] ] } }, "ImageConfig": { "Command": [ "restrict-default-sg/index.handler" ] }, "MemorySize": 256, "PackageType": "Image", "Role": { "Fn::GetAtt": [ "RestrictDefaultSgFnServiceRole84BA8496", "Arn" ] }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Timeout": 30 }, "DependsOn": [ "RestrictDefaultSgFnServiceRoleDefaultPolicyC4488902", "RestrictDefaultSgFnServiceRole84BA8496" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/RestrictDefaultSgFn/Resource" } }, "RestrictDefaultSg": { "Type": "Custom::VpcRestrictDefaultSG", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "RestrictDefaultSgFn9C75A0B7", "Arn" ] }, "DefaultSecurityGroupId": { "Fn::GetAtt": [ "NetworkVpc7FB7348F", "DefaultSecurityGroup" ] }, "Account": { "Ref": "AWS::AccountId" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/RestrictDefaultSg/Default" } }, "SupabaseSecretsSecret6D32C82D": { "Type": "AWS::SecretsManager::Secret", "Properties": { "GenerateSecretString": {}, "Name": "bb-appliance/supabase-shared", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseSecrets/Secret/Resource" } }, "SupabaseSecretsKeygenFunctionServiceRole80A5E669": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseSecrets/KeygenFunction/ServiceRole/Resource" } }, "SupabaseSecretsKeygenFunctionServiceRoleDefaultPolicy4F1278AC": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "secretsmanager:PutSecretValue", "secretsmanager:GetSecretValue" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } } ], "Version": "2012-10-17" }, "PolicyName": "SupabaseSecretsKeygenFunctionServiceRoleDefaultPolicy4F1278AC", "Roles": [ { "Ref": "SupabaseSecretsKeygenFunctionServiceRole80A5E669" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseSecrets/KeygenFunction/ServiceRole/DefaultPolicy/Resource" } }, "SupabaseSecretsKeygenFunction40FBF07E": { "Type": "AWS::Lambda::Function", "Properties": { "Architectures": [ "arm64" ], "Code": { "ImageUri": { "Fn::Join": [ "", [ { "Fn::Select": [ 4, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".dkr.ecr.", { "Fn::Select": [ 3, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".", { "Ref": "AWS::URLSuffix" }, "/", { "Ref": "LambdaImageCloneRepositoryE1F8FF7B" }, "@sha256:", { "Fn::GetAtt": [ "LambdaImageClone2364B1C9", "ImageDigestHex" ] } ] ] } }, "ImageConfig": { "Command": [ "supabase-keygen/index.handler" ] }, "MemorySize": 256, "PackageType": "Image", "Role": { "Fn::GetAtt": [ "SupabaseSecretsKeygenFunctionServiceRole80A5E669", "Arn" ] }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Timeout": 30 }, "DependsOn": [ "SupabaseSecretsKeygenFunctionServiceRoleDefaultPolicy4F1278AC", "SupabaseSecretsKeygenFunctionServiceRole80A5E669" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseSecrets/KeygenFunction/Resource" } }, "SupabaseSecretsDirectCustomResource5D59AB6E": { "Type": "AWS::CloudFormation::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "SupabaseSecretsKeygenFunction40FBF07E", "Arn" ] }, "SecretArn": { "Ref": "SupabaseSecretsSecret6D32C82D" }, "KeyInventoryHash": "065d8697b65b4b7d66370e7d7bb64bdf7c8e4398067701a207d41c9297f628dc" }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseSecrets/DirectCustomResource/Default" } }, "StorageBucket89AAB286": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "BucketKeyEnabled": true, "ServerSideEncryptionByDefault": { "SSEAlgorithm": "aws:kms" } } ] }, "BucketName": { "Fn::Join": [ "", [ "bb-appliance-storage-", { "Ref": "AWS::AccountId" } ] ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/StorageBucket/Bucket/Resource" } }, "StorageBucketPolicy8D8F7270": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "StorageBucket89AAB286" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "StorageBucket89AAB286", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "StorageBucket89AAB286", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/StorageBucket/Bucket/Policy/Resource" } }, "PostgresSg2CB3B58C": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "bb-appliance postgres - 5432 from the VPC only", "GroupName": "bb-appliance-postgres", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "SecurityGroupIngress": [ { "CidrIp": { "Fn::GetAtt": [ "NetworkVpc7FB7348F", "CidrBlock" ] }, "Description": "Postgres from within the VPC", "FromPort": 5432, "IpProtocol": "tcp", "ToPort": 5432 } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Postgres/Sg/Resource" } }, "PostgresRole18EFFF35": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ec2.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/AmazonSSMManagedInstanceCore" ] ] } ], "RoleName": "bb-appliance-postgres", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Postgres/Role/Resource" } }, "PostgresRoleDefaultPolicy8C124446": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } }, { "Action": "s3:PutObject", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "StorageBucket89AAB286", "Arn" ] }, "/pgdump/*" ] ] } }, { "Action": "cloudwatch:PutMetricData", "Effect": "Allow", "Resource": "*" }, { "Action": "ecr:GetAuthorizationToken", "Effect": "Allow", "Resource": "*" }, { "Action": [ "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability" ], "Effect": "Allow", "Resource": { "Fn::Sub": "arn:${AWS::Partition}:ecr:us-east-1:709825985650:repository/brainbase-labs/bb2-supabase-postgres" } } ], "Version": "2012-10-17" }, "PolicyName": "PostgresRoleDefaultPolicy8C124446", "Roles": [ { "Ref": "PostgresRole18EFFF35" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Postgres/Role/DefaultPolicy/Resource" } }, "PostgresInstanceInstanceProfileC3B11774": { "Type": "AWS::IAM::InstanceProfile", "Properties": { "Roles": [ { "Ref": "PostgresRole18EFFF35" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Postgres/Instance/InstanceProfile" } }, "PostgresInstanceEC667DB9": { "Type": "AWS::EC2::Instance", "Properties": { "AvailabilityZone": { "Fn::Select": [ 0, { "Fn::GetAZs": "" } ] }, "BlockDeviceMappings": [ { "DeviceName": "/dev/xvda", "Ebs": { "Encrypted": true, "VolumeSize": 20, "VolumeType": "gp3" } } ], "IamInstanceProfile": { "Ref": "PostgresInstanceInstanceProfileC3B11774" }, "ImageId": { "Fn::FindInMap": [ "PostgresPostgresAmiByRegion20715B83", { "Ref": "AWS::Region" }, "ami" ] }, "InstanceType": "m7g.large", "SecurityGroupIds": [ { "Fn::GetAtt": [ "PostgresSg2CB3B58C", "GroupId" ] } ], "SubnetId": { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" }, { "Key": "Name", "Value": "bb-appliance-postgres" } ], "UserData": { "Fn::Base64": { "Fn::Join": [ "", [ "#!/bin/bash\nset -euo pipefail\n# AL2023's dnf package is \"awscli-2\" (there is no \"awscli\"); the old name made dnf\n# exit non-zero and set -euo pipefail killed the script before Postgres ever started.\n# It installs the v2 CLI at /usr/bin/aws, which is what the secret fetch below (and the\n# pg_dump cron job) invoke.\n# cronie is REQUIRED for the nightly backup below: AL2023 ships no cron daemon, so\n# without it /etc/cron.d/bb-pgdump is inert and pg_dump never runs (the backup silently\n# never happened — audit 2026-08-17). Install it and enable crond alongside docker.\ndnf install -y docker jq awscli-2 cronie && systemctl enable --now docker crond\n\n# EBS attach can complete after user-data starts (CfnVolumeAttachment is a separate\n# resource from the instance); wait for the device rather than dying at blkid/mkfs.\nfor i in $(seq 1 60); do [ -e /dev/nvme1n1 ] && break; sleep 5; done\n[ -e /dev/nvme1n1 ] || { echo \"/dev/nvme1n1 did not appear after 300s\" >&2; exit 1; }\n\n# Data volume: format on first boot only, mount at /srv/pgdata\nif ! blkid /dev/nvme1n1 >/dev/null 2>&1; then mkfs.ext4 /dev/nvme1n1; fi\nmkdir -p /srv/pgdata && mount /dev/nvme1n1 /srv/pgdata\necho \"/dev/nvme1n1 /srv/pgdata ext4 defaults,nofail 0 2\" >> /etc/fstab\n# Use a SUBDIRECTORY of the mount as the data dir, never the mount root: a fresh\n# ext4 volume has a lost+found at its root, and postgres initdb refuses a\n# non-empty data directory (\"directory exists but is not empty ... lost+found\").\n# initdb's own hint says to use a subdirectory. This subdir is what the container\n# bind-mounts as /var/lib/postgresql/data.\nmkdir -p /srv/pgdata/pgdata\nS=$(aws secretsmanager get-secret-value --secret-id ", { "Ref": "SupabaseSecretsSecret6D32C82D" }, " --query SecretString --output text)\nPGPW=\"$(jq -r .POSTGRES_PASSWORD <<<\"$S\")\"\n# Env list ported from the pinned upstream compose db-service block (supabase/supabase\n# docker/docker-compose.yml, `db:` service - PGPORT/PGPASSWORD/PGDATABASE are libpq-native\n# synonyms upstream sets alongside the POSTGRES_* vars; JWT_EXP mirrors upstream JWT_EXPIRY).\nIMAGE=709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-supabase-postgres:15.14.1.165\n# Private registry: the IAM role authorizes the pull, but the Docker daemon still\n# needs a login token. Derive host + region from the image ref itself so the same\n# line serves both synth modes (producer: our account's registry; marketplace: the\n# buyer's ImageRegistryPrefix host).\nREG_HOST=\"${IMAGE%%/*}\"\naws ecr get-login-password --region \"$(cut -d. -f4 <<<\"$REG_HOST\")\" \\\n | docker login --username AWS --password-stdin \"$REG_HOST\" >/dev/null\n\ndocker run -d --name supabase-db --restart unless-stopped \\\n -p 5432:5432 \\\n -e POSTGRES_PASSWORD=\"$PGPW\" \\\n -e PGPASSWORD=\"$PGPW\" \\\n -e JWT_SECRET=\"$(jq -r .JWT_SECRET <<<\"$S\")\" \\\n -e JWT_EXP=3600 \\\n -e POSTGRES_HOST=/var/run/postgresql -e POSTGRES_PORT=5432 -e PGPORT=5432 \\\n -e POSTGRES_DB=postgres -e PGDATABASE=postgres \\\n -v /srv/pgdata/pgdata:/var/lib/postgresql/data \\\n \"$IMAGE\" \\\n postgres -c config_file=/etc/postgresql/postgresql.conf -c log_min_messages=fatal\n\n# Wait for Postgres to accept connections (bounded: 60 x 2s = 120s) before running init SQL.\nwait_count=0\nuntil docker exec supabase-db pg_isready -U supabase_admin >/dev/null 2>&1; do\n wait_count=$((wait_count + 1))\n if [ \"$wait_count\" -ge 60 ]; then\n echo \"supabase-db did not become ready after 120s\" >&2\n exit 1\n fi\n sleep 2\ndone\n\n# In-scope init SQL ported from the pinned upstream compose (supabase/supabase\n# docker/volumes/db/{roles,realtime}.sql) - jwt/webhooks/pooler/_supabase/logs.sql are\n# deferred (JWT is delivered via container env; the rest serve components we don't ship).\n# Idempotent: ALTER USER and CREATE SCHEMA IF NOT EXISTS are both safe to re-run on reboot.\n# The password never appears as a docker-exec argument (so it's not visible via `ps`/`docker\n# top`) or in this script's own text: psql pulls it from the container's own POSTGRES_PASSWORD\n# env var via a backtick \\set, exactly as upstream's roles.sql does.\n# Only ALTER roles that actually exist in this image: the pinned\n# supabase-postgres image (mirrored into our ECR as bb-appliance/supabase-postgres)\n# creates authenticator/pgbouncer/supabase_auth_admin/\n# supabase_storage_admin but NOT supabase_functions_admin (the functions feature\n# isn't shipped). A bare `ALTER USER supabase_functions_admin` aborts under\n# ON_ERROR_STOP. The SELECT ... \\gexec pattern emits an ALTER only for rows that\n# match pg_roles, so absent roles are silently skipped — idempotent and\n# image-version-agnostic.\ndocker exec -i supabase-db psql -v ON_ERROR_STOP=1 -U supabase_admin -d postgres <<'SQL'\n\\set pgpass `echo \"$POSTGRES_PASSWORD\"`\nSELECT format('ALTER USER %I WITH PASSWORD %L', rolname, :'pgpass')\nFROM pg_roles\nWHERE rolname IN ('authenticator','pgbouncer','supabase_auth_admin','supabase_functions_admin','supabase_storage_admin')\n\\gexec\n\nCREATE SCHEMA IF NOT EXISTS _realtime;\nALTER SCHEMA _realtime OWNER TO supabase_admin;\nSQL\n\n# Nightly logical backup (spec §4): pg_dump -> gzip -> s3:///pgdump/.sql.gz.\n# The dump lives in a script (not an inline cron line) so it can emit a CloudWatch\n# success metric AFTER a verified upload: bb-appliance/PgdumpSuccess=1. A dead cron,\n# a failed dump, or a failed upload all leave the metric unpublished, which the\n# bb-appliance-pgdump-stale alarm (observability.ts, treatMissingData=BREACHING) turns\n# into a page. set -o pipefail so a pg_dump failure upstream of a successful gzip/cp\n# still aborts before the metric is emitted.\ncat > /usr/local/bin/bb-pgdump.sh <<'SH'\n#!/bin/bash\nset -euo pipefail\ndocker exec supabase-db pg_dump -U supabase_admin -d postgres | gzip | aws s3 cp - \"s3://", { "Ref": "StorageBucket89AAB286" }, "/pgdump/$(date +%F).sql.gz\"\naws cloudwatch put-metric-data --namespace bb-appliance --metric-name PgdumpSuccess --value 1 --region ", { "Ref": "AWS::Region" }, "\nSH\nchmod +x /usr/local/bin/bb-pgdump.sh\ncat > /etc/cron.d/bb-pgdump <<'CRON'\n15 9 * * * root /usr/local/bin/bb-pgdump.sh >> /var/log/bb-pgdump.log 2>&1\nCRON\nchmod 0644 /etc/cron.d/bb-pgdump\n" ] ] } } }, "DependsOn": [ "PostgresRoleDefaultPolicy8C124446", "PostgresRole18EFFF35" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Postgres/Instance/Resource" } }, "PostgresDataVolumeRestored5920BA92": { "Type": "AWS::EC2::Volume", "Properties": { "AvailabilityZone": { "Fn::GetAtt": [ "PostgresInstanceEC667DB9", "AvailabilityZone" ] }, "Encrypted": true, "MultiAttachEnabled": false, "Size": 200, "Tags": [ { "Key": "bb-appliance-db-data", "Value": "true" }, { "Key": "brainbase-appliance", "Value": "v1" }, { "Key": "Name", "Value": "bb-appliance-postgres-data" } ], "VolumeType": "gp3" }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Postgres/DataVolumeRestored/Resource" } }, "PostgresDataVolumeAttachmentE0771E01": { "Type": "AWS::EC2::VolumeAttachment", "Properties": { "Device": "/dev/sdf", "InstanceId": { "Ref": "PostgresInstanceEC667DB9" }, "VolumeId": { "Ref": "PostgresDataVolumeRestored5920BA92" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Postgres/DataVolumeAttachment" } }, "PostgresDlmRole1F2AE87A": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "dlm.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSDataLifecycleManagerServiceRole" ] ] } ], "RoleName": "bb-appliance-dlm", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Postgres/DlmRole/Resource" } }, "PostgresDataVolumeSnapshotPolicyA17A3229": { "Type": "AWS::DLM::LifecyclePolicy", "Properties": { "Description": "bb-appliance-postgres-data nightly snapshot", "ExecutionRoleArn": { "Fn::GetAtt": [ "PostgresDlmRole1F2AE87A", "Arn" ] }, "PolicyDetails": { "ResourceTypes": [ "VOLUME" ], "Schedules": [ { "CreateRule": { "Interval": 24, "IntervalUnit": "HOURS", "Times": [ "09:00" ] }, "Name": "bb-appliance-postgres-data-daily", "RetainRule": { "Count": 7 } } ], "TargetTags": [ { "Key": "bb-appliance-db-data", "Value": "true" } ] }, "State": "ENABLED", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Postgres/DataVolumeSnapshotPolicy" } }, "SupabaseServicesAuthTaskDefTaskRole5BADF343": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "SesSmtpDirectCustomResourceA017E0D6" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Auth/TaskDef/TaskRole/Resource" } }, "SupabaseServicesAuthTaskDef0C561D84": { "Type": "AWS::ECS::TaskDefinition", "Properties": { "ContainerDefinitions": [ { "Environment": [ { "Name": "GOTRUE_API_HOST", "Value": "0.0.0.0" }, { "Name": "GOTRUE_API_PORT", "Value": "9999" }, { "Name": "API_EXTERNAL_URL", "Value": { "Fn::Join": [ "", [ "https://supabase.", { "Ref": "DomainName" }, "/auth/v1" ] ] } }, { "Name": "GOTRUE_DB_DRIVER", "Value": "postgres" }, { "Name": "POSTGRES_HOST", "Value": { "Fn::GetAtt": [ "PostgresInstanceEC667DB9", "PrivateDnsName" ] } }, { "Name": "POSTGRES_PORT", "Value": "5432" }, { "Name": "POSTGRES_DB", "Value": "postgres" }, { "Name": "GOTRUE_SITE_URL", "Value": { "Fn::Join": [ "", [ "https://app.", { "Ref": "DomainName" } ] ] } }, { "Name": "GOTRUE_URI_ALLOW_LIST", "Value": { "Fn::Join": [ "", [ "https://app.", { "Ref": "DomainName" }, "/**" ] ] } }, { "Name": "GOTRUE_MAILER_URLPATHS_CONFIRMATION", "Value": "/auth/v1/verify" }, { "Name": "GOTRUE_MAILER_URLPATHS_INVITE", "Value": "/auth/v1/verify" }, { "Name": "GOTRUE_MAILER_URLPATHS_RECOVERY", "Value": "/auth/v1/verify" }, { "Name": "GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE", "Value": "/auth/v1/verify" }, { "Name": "GOTRUE_JWT_ADMIN_ROLES", "Value": "service_role" }, { "Name": "GOTRUE_JWT_AUD", "Value": "authenticated" }, { "Name": "GOTRUE_JWT_DEFAULT_GROUP_NAME", "Value": "authenticated" }, { "Name": "GOTRUE_JWT_ISSUER", "Value": { "Fn::Join": [ "", [ "https://supabase.", { "Ref": "DomainName" }, "/auth/v1" ] ] } }, { "Name": "GOTRUE_MAILER_AUTOCONFIRM", "Value": "true" }, { "Name": "GOTRUE_DISABLE_SIGNUP", "Value": "true" }, { "Name": "BB_SES_SMTP_ROTATION_NONCE", "Value": "1" } ], "Essential": true, "Image": "709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-gotrue:ctx-733a02025fe3", "LogConfiguration": { "LogDriver": "awslogs", "Options": { "awslogs-group": { "Ref": "SupabaseServicesAuthLogs756063FF" }, "awslogs-stream-prefix": "auth", "awslogs-region": { "Ref": "AWS::Region" } } }, "Name": "app", "PortMappings": [ { "ContainerPort": 9999, "Name": "auth", "Protocol": "tcp" } ], "Secrets": [ { "Name": "GOTRUE_JWT_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":JWT_SECRET::" ] ] } }, { "Name": "POSTGRES_PASSWORD", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":POSTGRES_PASSWORD::" ] ] } }, { "Name": "GOTRUE_SMTP_HOST", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SMTP_HOST::" ] ] } }, { "Name": "GOTRUE_SMTP_PORT", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SMTP_PORT::" ] ] } }, { "Name": "GOTRUE_SMTP_USER", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SMTP_USER::" ] ] } }, { "Name": "GOTRUE_SMTP_PASS", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SMTP_PASS::" ] ] } }, { "Name": "GOTRUE_SMTP_ADMIN_EMAIL", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SMTP_ADMIN_EMAIL::" ] ] } }, { "Name": "GOTRUE_SMTP_SENDER_NAME", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SMTP_SENDER_NAME::" ] ] } } ] } ], "Cpu": "512", "ExecutionRoleArn": { "Fn::GetAtt": [ "SupabaseServicesAuthTaskDefExecutionRole87B59333", "Arn" ] }, "Family": "bb-appliance-auth", "Memory": "1024", "NetworkMode": "awsvpc", "RequiresCompatibilities": [ "FARGATE" ], "RuntimePlatform": { "CpuArchitecture": "ARM64" }, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskRoleArn": { "Fn::GetAtt": [ "SupabaseServicesAuthTaskDefTaskRole5BADF343", "Arn" ] } }, "DependsOn": [ "SesSmtpDirectCustomResourceA017E0D6" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Auth/TaskDef/Resource" } }, "SupabaseServicesAuthTaskDefExecutionRole87B59333": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "SesSmtpDirectCustomResourceA017E0D6" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Auth/TaskDef/ExecutionRole/Resource" } }, "SupabaseServicesAuthTaskDefExecutionRoleDefaultPolicy1F771EF6": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "SupabaseServicesAuthLogs756063FF", "Arn" ] } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } } ], "Version": "2012-10-17" }, "PolicyName": "SupabaseServicesAuthTaskDefExecutionRoleDefaultPolicy1F771EF6", "Roles": [ { "Ref": "SupabaseServicesAuthTaskDefExecutionRole87B59333" } ] }, "DependsOn": [ "SesSmtpDirectCustomResourceA017E0D6" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Auth/TaskDef/ExecutionRole/DefaultPolicy/Resource" } }, "SupabaseServicesAuthLogs756063FF": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": "/bb-appliance/auth", "RetentionInDays": 30, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "SesSmtpDirectCustomResourceA017E0D6" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Auth/Logs/Resource" } }, "SupabaseServicesAuthService356006B7": { "Type": "AWS::ECS::Service", "Properties": { "Cluster": { "Ref": "ClusterEB0386A7" }, "DeploymentConfiguration": { "Alarms": { "AlarmNames": [], "Enable": false, "Rollback": false }, "DeploymentCircuitBreaker": { "Enable": true, "Rollback": false }, "MaximumPercent": 200, "MinimumHealthyPercent": 50 }, "DeploymentController": { "Type": "ECS" }, "DesiredCount": 1, "EnableECSManagedTags": false, "LaunchType": "FARGATE", "NetworkConfiguration": { "AwsvpcConfiguration": { "AssignPublicIp": "DISABLED", "SecurityGroups": [ { "Fn::GetAtt": [ "SupabaseServicesAuthServiceSecurityGroup90B77866", "GroupId" ] } ], "Subnets": [ { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" }, { "Ref": "NetworkVpcappSubnet2SubnetC46F4198" } ] } }, "ServiceConnectConfiguration": { "Enabled": true, "Namespace": "bb-appliance.local", "Services": [ { "ClientAliases": [ { "Port": 9999 } ], "DiscoveryName": "auth", "PortName": "auth" } ] }, "ServiceName": "bb-appliance-auth", "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskDefinition": { "Ref": "SupabaseServicesAuthTaskDef0C561D84" } }, "DependsOn": [ "SesSmtpDirectCustomResourceA017E0D6", "SupabaseServicesAuthTaskDefTaskRole5BADF343" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Auth/Service/Service" } }, "SupabaseServicesAuthServiceSecurityGroup90B77866": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "BrainbaseAppliance/SupabaseServices/Auth/Service/SecurityGroup", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "SesSmtpDirectCustomResourceA017E0D6", "SupabaseServicesAuthTaskDefTaskRole5BADF343" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Auth/Service/SecurityGroup/Resource" } }, "SupabaseServicesAuthServiceSecurityGroupfromBrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE86999966C8E8E3": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "Description": "from BrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE86:9999", "FromPort": 9999, "GroupId": { "Fn::GetAtt": [ "SupabaseServicesAuthServiceSecurityGroup90B77866", "GroupId" ] }, "IpProtocol": "tcp", "SourceSecurityGroupId": { "Fn::GetAtt": [ "SupabaseServicesKongServiceSecurityGroupB4255BEF", "GroupId" ] }, "ToPort": 9999 }, "DependsOn": [ "SesSmtpDirectCustomResourceA017E0D6", "SupabaseServicesAuthTaskDefTaskRole5BADF343" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Auth/Service/SecurityGroup/from BrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE86:9999" } }, "SupabaseServicesAuthServiceTaskCountTarget50FB4C1E": { "Type": "AWS::ApplicationAutoScaling::ScalableTarget", "Properties": { "MaxCapacity": 4, "MinCapacity": 1, "ResourceId": { "Fn::Join": [ "", [ "service/", { "Ref": "ClusterEB0386A7" }, "/", { "Fn::GetAtt": [ "SupabaseServicesAuthService356006B7", "Name" ] } ] ] }, "RoleARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService" ] ] }, "ScalableDimension": "ecs:service:DesiredCount", "ServiceNamespace": "ecs" }, "DependsOn": [ "SesSmtpDirectCustomResourceA017E0D6", "SupabaseServicesAuthTaskDefTaskRole5BADF343" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Auth/Service/TaskCount/Target/Resource" } }, "SupabaseServicesAuthServiceTaskCountTargetCpu123E324D": { "Type": "AWS::ApplicationAutoScaling::ScalingPolicy", "Properties": { "PolicyName": "BrainbaseApplianceSupabaseServicesAuthServiceTaskCountTargetCpu4D50AC12", "PolicyType": "TargetTrackingScaling", "ScalingTargetId": { "Ref": "SupabaseServicesAuthServiceTaskCountTarget50FB4C1E" }, "TargetTrackingScalingPolicyConfiguration": { "PredefinedMetricSpecification": { "PredefinedMetricType": "ECSServiceAverageCPUUtilization" }, "TargetValue": 60 } }, "DependsOn": [ "SesSmtpDirectCustomResourceA017E0D6", "SupabaseServicesAuthTaskDefTaskRole5BADF343" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Auth/Service/TaskCount/Target/Cpu/Resource" } }, "SupabaseServicesRestTaskDefTaskRole16369689": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Rest/TaskDef/TaskRole/Resource" } }, "SupabaseServicesRestTaskDef41452BB2": { "Type": "AWS::ECS::TaskDefinition", "Properties": { "ContainerDefinitions": [ { "Environment": [ { "Name": "PGRST_DB_URI", "Value": "postgresql://" }, { "Name": "PGHOST", "Value": { "Fn::GetAtt": [ "PostgresInstanceEC667DB9", "PrivateDnsName" ] } }, { "Name": "PGPORT", "Value": "5432" }, { "Name": "PGUSER", "Value": "authenticator" }, { "Name": "PGDATABASE", "Value": "postgres" }, { "Name": "PGRST_DB_SCHEMAS", "Value": "public" }, { "Name": "PGRST_DB_MAX_ROWS", "Value": "1000" }, { "Name": "PGRST_DB_EXTRA_SEARCH_PATH", "Value": "public" }, { "Name": "PGRST_DB_ANON_ROLE", "Value": "anon" }, { "Name": "PGRST_ADMIN_SERVER_PORT", "Value": "3001" }, { "Name": "PGRST_ADMIN_SERVER_HOST", "Value": "localhost" }, { "Name": "PGRST_DB_USE_LEGACY_GUCS", "Value": "false" } ], "Essential": true, "Image": "709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-postgrest:mirror-844785450d6b", "LogConfiguration": { "LogDriver": "awslogs", "Options": { "awslogs-group": { "Ref": "SupabaseServicesRestLogs716A8478" }, "awslogs-stream-prefix": "rest", "awslogs-region": { "Ref": "AWS::Region" } } }, "Name": "app", "PortMappings": [ { "ContainerPort": 3000, "Name": "rest", "Protocol": "tcp" } ], "Secrets": [ { "Name": "PGPASSWORD", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":POSTGRES_PASSWORD::" ] ] } }, { "Name": "PGRST_JWT_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":JWT_SECRET::" ] ] } }, { "Name": "PGRST_APP_SETTINGS_JWT_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":JWT_SECRET::" ] ] } } ] } ], "Cpu": "512", "ExecutionRoleArn": { "Fn::GetAtt": [ "SupabaseServicesRestTaskDefExecutionRole2FDCFCD0", "Arn" ] }, "Family": "bb-appliance-rest", "Memory": "1024", "NetworkMode": "awsvpc", "RequiresCompatibilities": [ "FARGATE" ], "RuntimePlatform": { "CpuArchitecture": "ARM64" }, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskRoleArn": { "Fn::GetAtt": [ "SupabaseServicesRestTaskDefTaskRole16369689", "Arn" ] } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Rest/TaskDef/Resource" } }, "SupabaseServicesRestTaskDefExecutionRole2FDCFCD0": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Rest/TaskDef/ExecutionRole/Resource" } }, "SupabaseServicesRestTaskDefExecutionRoleDefaultPolicy5F70A790": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "SupabaseServicesRestLogs716A8478", "Arn" ] } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } } ], "Version": "2012-10-17" }, "PolicyName": "SupabaseServicesRestTaskDefExecutionRoleDefaultPolicy5F70A790", "Roles": [ { "Ref": "SupabaseServicesRestTaskDefExecutionRole2FDCFCD0" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Rest/TaskDef/ExecutionRole/DefaultPolicy/Resource" } }, "SupabaseServicesRestLogs716A8478": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": "/bb-appliance/rest", "RetentionInDays": 30, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ] }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Rest/Logs/Resource" } }, "SupabaseServicesRestService8CB6B129": { "Type": "AWS::ECS::Service", "Properties": { "Cluster": { "Ref": "ClusterEB0386A7" }, "DeploymentConfiguration": { "Alarms": { "AlarmNames": [], "Enable": false, "Rollback": false }, "DeploymentCircuitBreaker": { "Enable": true, "Rollback": false }, "MaximumPercent": 200, "MinimumHealthyPercent": 50 }, "DeploymentController": { "Type": "ECS" }, "DesiredCount": 1, "EnableECSManagedTags": false, "LaunchType": "FARGATE", "NetworkConfiguration": { "AwsvpcConfiguration": { "AssignPublicIp": "DISABLED", "SecurityGroups": [ { "Fn::GetAtt": [ "SupabaseServicesRestServiceSecurityGroupDCE71BA1", "GroupId" ] } ], "Subnets": [ { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" }, { "Ref": "NetworkVpcappSubnet2SubnetC46F4198" } ] } }, "ServiceConnectConfiguration": { "Enabled": true, "Namespace": "bb-appliance.local", "Services": [ { "ClientAliases": [ { "Port": 3000 } ], "DiscoveryName": "rest", "PortName": "rest" } ] }, "ServiceName": "bb-appliance-rest", "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskDefinition": { "Ref": "SupabaseServicesRestTaskDef41452BB2" } }, "DependsOn": [ "SupabaseServicesRestTaskDefTaskRole16369689" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Rest/Service/Service" } }, "SupabaseServicesRestServiceSecurityGroupDCE71BA1": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "BrainbaseAppliance/SupabaseServices/Rest/Service/SecurityGroup", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "SupabaseServicesRestTaskDefTaskRole16369689" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Rest/Service/SecurityGroup/Resource" } }, "SupabaseServicesRestServiceSecurityGroupfromBrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE86300040F17C95": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "Description": "from BrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE86:3000", "FromPort": 3000, "GroupId": { "Fn::GetAtt": [ "SupabaseServicesRestServiceSecurityGroupDCE71BA1", "GroupId" ] }, "IpProtocol": "tcp", "SourceSecurityGroupId": { "Fn::GetAtt": [ "SupabaseServicesKongServiceSecurityGroupB4255BEF", "GroupId" ] }, "ToPort": 3000 }, "DependsOn": [ "SupabaseServicesRestTaskDefTaskRole16369689" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Rest/Service/SecurityGroup/from BrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE86:3000" } }, "SupabaseServicesRestServiceSecurityGroupfromBrainbaseApplianceSupabaseServicesStorageServiceSecurityGroupD91377443000FA4B05D3": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "Description": "from BrainbaseApplianceSupabaseServicesStorageServiceSecurityGroupD9137744:3000", "FromPort": 3000, "GroupId": { "Fn::GetAtt": [ "SupabaseServicesRestServiceSecurityGroupDCE71BA1", "GroupId" ] }, "IpProtocol": "tcp", "SourceSecurityGroupId": { "Fn::GetAtt": [ "SupabaseServicesStorageServiceSecurityGroupDBCF0E7A", "GroupId" ] }, "ToPort": 3000 }, "DependsOn": [ "SupabaseServicesRestTaskDefTaskRole16369689" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Rest/Service/SecurityGroup/from BrainbaseApplianceSupabaseServicesStorageServiceSecurityGroupD9137744:3000" } }, "SupabaseServicesRestServiceTaskCountTargetBF4A6AFE": { "Type": "AWS::ApplicationAutoScaling::ScalableTarget", "Properties": { "MaxCapacity": 4, "MinCapacity": 1, "ResourceId": { "Fn::Join": [ "", [ "service/", { "Ref": "ClusterEB0386A7" }, "/", { "Fn::GetAtt": [ "SupabaseServicesRestService8CB6B129", "Name" ] } ] ] }, "RoleARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService" ] ] }, "ScalableDimension": "ecs:service:DesiredCount", "ServiceNamespace": "ecs" }, "DependsOn": [ "SupabaseServicesRestTaskDefTaskRole16369689" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Rest/Service/TaskCount/Target/Resource" } }, "SupabaseServicesRestServiceTaskCountTargetCpu0A1FEDD9": { "Type": "AWS::ApplicationAutoScaling::ScalingPolicy", "Properties": { "PolicyName": "BrainbaseApplianceSupabaseServicesRestServiceTaskCountTargetCpu07C919A2", "PolicyType": "TargetTrackingScaling", "ScalingTargetId": { "Ref": "SupabaseServicesRestServiceTaskCountTargetBF4A6AFE" }, "TargetTrackingScalingPolicyConfiguration": { "PredefinedMetricSpecification": { "PredefinedMetricType": "ECSServiceAverageCPUUtilization" }, "TargetValue": 60 } }, "DependsOn": [ "SupabaseServicesRestTaskDefTaskRole16369689" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Rest/Service/TaskCount/Target/Cpu/Resource" } }, "SupabaseServicesRealtimeTaskDefTaskRole4B5FB579": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Realtime/TaskDef/TaskRole/Resource" } }, "SupabaseServicesRealtimeTaskDef0709EC2E": { "Type": "AWS::ECS::TaskDefinition", "Properties": { "ContainerDefinitions": [ { "Environment": [ { "Name": "PORT", "Value": "4000" }, { "Name": "DB_HOST", "Value": { "Fn::GetAtt": [ "PostgresInstanceEC667DB9", "PrivateDnsName" ] } }, { "Name": "DB_PORT", "Value": "5432" }, { "Name": "DB_USER", "Value": "supabase_admin" }, { "Name": "DB_NAME", "Value": "postgres" }, { "Name": "DB_AFTER_CONNECT_QUERY", "Value": "SET search_path TO _realtime" }, { "Name": "ERL_AFLAGS", "Value": "-proto_dist inet_tcp" }, { "Name": "DNS_NODES", "Value": "''" }, { "Name": "RLIMIT_NOFILE", "Value": "10000" }, { "Name": "APP_NAME", "Value": "realtime" }, { "Name": "SEED_SELF_HOST", "Value": "true" }, { "Name": "SELF_HOST_TENANT_NAME", "Value": "realtime" }, { "Name": "RUN_JANITOR", "Value": "true" }, { "Name": "DISABLE_HEALTHCHECK_LOGGING", "Value": "true" } ], "Essential": true, "Image": "709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-realtime:mirror-11651eb26063", "LogConfiguration": { "LogDriver": "awslogs", "Options": { "awslogs-group": { "Ref": "SupabaseServicesRealtimeLogsD8D7998E" }, "awslogs-stream-prefix": "realtime", "awslogs-region": { "Ref": "AWS::Region" } } }, "Name": "app", "PortMappings": [ { "ContainerPort": 4000, "Name": "realtime", "Protocol": "tcp" } ], "Secrets": [ { "Name": "DB_PASSWORD", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":POSTGRES_PASSWORD::" ] ] } }, { "Name": "DB_ENC_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":REALTIME_DB_ENC_KEY::" ] ] } }, { "Name": "API_JWT_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":JWT_SECRET::" ] ] } }, { "Name": "METRICS_JWT_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":JWT_SECRET::" ] ] } }, { "Name": "SECRET_KEY_BASE", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SECRET_KEY_BASE::" ] ] } } ] } ], "Cpu": "512", "ExecutionRoleArn": { "Fn::GetAtt": [ "SupabaseServicesRealtimeTaskDefExecutionRoleCF709404", "Arn" ] }, "Family": "bb-appliance-realtime", "Memory": "1024", "NetworkMode": "awsvpc", "RequiresCompatibilities": [ "FARGATE" ], "RuntimePlatform": { "CpuArchitecture": "ARM64" }, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskRoleArn": { "Fn::GetAtt": [ "SupabaseServicesRealtimeTaskDefTaskRole4B5FB579", "Arn" ] } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Realtime/TaskDef/Resource" } }, "SupabaseServicesRealtimeTaskDefExecutionRoleCF709404": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Realtime/TaskDef/ExecutionRole/Resource" } }, "SupabaseServicesRealtimeTaskDefExecutionRoleDefaultPolicy875C2075": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "SupabaseServicesRealtimeLogsD8D7998E", "Arn" ] } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } } ], "Version": "2012-10-17" }, "PolicyName": "SupabaseServicesRealtimeTaskDefExecutionRoleDefaultPolicy875C2075", "Roles": [ { "Ref": "SupabaseServicesRealtimeTaskDefExecutionRoleCF709404" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Realtime/TaskDef/ExecutionRole/DefaultPolicy/Resource" } }, "SupabaseServicesRealtimeLogsD8D7998E": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": "/bb-appliance/realtime", "RetentionInDays": 30, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ] }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Realtime/Logs/Resource" } }, "SupabaseServicesRealtimeService66DA3761": { "Type": "AWS::ECS::Service", "Properties": { "Cluster": { "Ref": "ClusterEB0386A7" }, "DeploymentConfiguration": { "Alarms": { "AlarmNames": [], "Enable": false, "Rollback": false }, "DeploymentCircuitBreaker": { "Enable": true, "Rollback": false }, "MaximumPercent": 200, "MinimumHealthyPercent": 50 }, "DeploymentController": { "Type": "ECS" }, "DesiredCount": 1, "EnableECSManagedTags": false, "LaunchType": "FARGATE", "NetworkConfiguration": { "AwsvpcConfiguration": { "AssignPublicIp": "DISABLED", "SecurityGroups": [ { "Fn::GetAtt": [ "SupabaseServicesRealtimeServiceSecurityGroup33B14600", "GroupId" ] } ], "Subnets": [ { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" }, { "Ref": "NetworkVpcappSubnet2SubnetC46F4198" } ] } }, "ServiceConnectConfiguration": { "Enabled": true, "Namespace": "bb-appliance.local", "Services": [ { "ClientAliases": [ { "Port": 4000 } ], "DiscoveryName": "realtime", "PortName": "realtime" } ] }, "ServiceName": "bb-appliance-realtime", "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskDefinition": { "Ref": "SupabaseServicesRealtimeTaskDef0709EC2E" } }, "DependsOn": [ "SupabaseServicesRealtimeTaskDefTaskRole4B5FB579" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Realtime/Service/Service" } }, "SupabaseServicesRealtimeServiceSecurityGroup33B14600": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "BrainbaseAppliance/SupabaseServices/Realtime/Service/SecurityGroup", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "SupabaseServicesRealtimeTaskDefTaskRole4B5FB579" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Realtime/Service/SecurityGroup/Resource" } }, "SupabaseServicesRealtimeServiceSecurityGroupfromBrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE864000774D4D4B": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "Description": "from BrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE86:4000", "FromPort": 4000, "GroupId": { "Fn::GetAtt": [ "SupabaseServicesRealtimeServiceSecurityGroup33B14600", "GroupId" ] }, "IpProtocol": "tcp", "SourceSecurityGroupId": { "Fn::GetAtt": [ "SupabaseServicesKongServiceSecurityGroupB4255BEF", "GroupId" ] }, "ToPort": 4000 }, "DependsOn": [ "SupabaseServicesRealtimeTaskDefTaskRole4B5FB579" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Realtime/Service/SecurityGroup/from BrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE86:4000" } }, "SupabaseServicesStorageTaskDefTaskRoleDBBF54F6": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Storage/TaskDef/TaskRole/Resource" } }, "SupabaseServicesStorageTaskDefTaskRoleDefaultPolicyFD0B08BD": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:DeleteObject*", "s3:PutObject", "s3:PutObjectLegalHold", "s3:PutObjectRetention", "s3:PutObjectTagging", "s3:PutObjectVersionTagging", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "StorageBucket89AAB286", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "StorageBucket89AAB286", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "SupabaseServicesStorageTaskDefTaskRoleDefaultPolicyFD0B08BD", "Roles": [ { "Ref": "SupabaseServicesStorageTaskDefTaskRoleDBBF54F6" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Storage/TaskDef/TaskRole/DefaultPolicy/Resource" } }, "SupabaseServicesStorageTaskDef5755C94B": { "Type": "AWS::ECS::TaskDefinition", "Properties": { "ContainerDefinitions": [ { "Environment": [ { "Name": "POSTGRES_HOST", "Value": { "Fn::GetAtt": [ "PostgresInstanceEC667DB9", "PrivateDnsName" ] } }, { "Name": "POSTGRES_PORT", "Value": "5432" }, { "Name": "POSTGRES_DB", "Value": "postgres" }, { "Name": "POSTGREST_URL", "Value": "http://rest.bb-appliance.local:3000" }, { "Name": "STORAGE_PUBLIC_URL", "Value": { "Fn::Join": [ "", [ "https://supabase.", { "Ref": "DomainName" } ] ] } }, { "Name": "REQUEST_ALLOW_X_FORWARDED_PATH", "Value": "true" }, { "Name": "FILE_SIZE_LIMIT", "Value": "52428800" }, { "Name": "STORAGE_BACKEND", "Value": "s3" }, { "Name": "GLOBAL_S3_BUCKET", "Value": { "Ref": "StorageBucket89AAB286" } }, { "Name": "GLOBAL_S3_FORCE_PATH_STYLE", "Value": "false" }, { "Name": "TENANT_ID", "Value": "brainbase" }, { "Name": "REGION", "Value": { "Ref": "AWS::Region" } }, { "Name": "AWS_DEFAULT_REGION", "Value": { "Ref": "AWS::Region" } }, { "Name": "ENABLE_IMAGE_TRANSFORMATION", "Value": "false" } ], "Essential": true, "Image": "709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-storage-api:ctx-bf34f2540091", "LogConfiguration": { "LogDriver": "awslogs", "Options": { "awslogs-group": { "Ref": "SupabaseServicesStorageLogsAA1BBB12" }, "awslogs-stream-prefix": "storage", "awslogs-region": { "Ref": "AWS::Region" } } }, "Name": "app", "PortMappings": [ { "ContainerPort": 5000, "Name": "storage", "Protocol": "tcp" } ], "Secrets": [ { "Name": "ANON_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":ANON_KEY::" ] ] } }, { "Name": "SERVICE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SERVICE_ROLE_KEY::" ] ] } }, { "Name": "AUTH_JWT_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":JWT_SECRET::" ] ] } }, { "Name": "POSTGRES_PASSWORD", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":POSTGRES_PASSWORD::" ] ] } }, { "Name": "S3_PROTOCOL_ACCESS_KEY_ID", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":S3_PROTOCOL_ACCESS_KEY_ID::" ] ] } }, { "Name": "S3_PROTOCOL_ACCESS_KEY_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":S3_PROTOCOL_ACCESS_KEY_SECRET::" ] ] } } ] } ], "Cpu": "512", "ExecutionRoleArn": { "Fn::GetAtt": [ "SupabaseServicesStorageTaskDefExecutionRole119BA139", "Arn" ] }, "Family": "bb-appliance-storage", "Memory": "1024", "NetworkMode": "awsvpc", "RequiresCompatibilities": [ "FARGATE" ], "RuntimePlatform": { "CpuArchitecture": "ARM64" }, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskRoleArn": { "Fn::GetAtt": [ "SupabaseServicesStorageTaskDefTaskRoleDBBF54F6", "Arn" ] } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Storage/TaskDef/Resource" } }, "SupabaseServicesStorageTaskDefExecutionRole119BA139": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Storage/TaskDef/ExecutionRole/Resource" } }, "SupabaseServicesStorageTaskDefExecutionRoleDefaultPolicy3330CB8F": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "SupabaseServicesStorageLogsAA1BBB12", "Arn" ] } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } } ], "Version": "2012-10-17" }, "PolicyName": "SupabaseServicesStorageTaskDefExecutionRoleDefaultPolicy3330CB8F", "Roles": [ { "Ref": "SupabaseServicesStorageTaskDefExecutionRole119BA139" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Storage/TaskDef/ExecutionRole/DefaultPolicy/Resource" } }, "SupabaseServicesStorageLogsAA1BBB12": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": "/bb-appliance/storage", "RetentionInDays": 30, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ] }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Storage/Logs/Resource" } }, "SupabaseServicesStorageService10D87C2D": { "Type": "AWS::ECS::Service", "Properties": { "Cluster": { "Ref": "ClusterEB0386A7" }, "DeploymentConfiguration": { "Alarms": { "AlarmNames": [], "Enable": false, "Rollback": false }, "DeploymentCircuitBreaker": { "Enable": true, "Rollback": false }, "MaximumPercent": 200, "MinimumHealthyPercent": 50 }, "DeploymentController": { "Type": "ECS" }, "DesiredCount": 1, "EnableECSManagedTags": false, "LaunchType": "FARGATE", "NetworkConfiguration": { "AwsvpcConfiguration": { "AssignPublicIp": "DISABLED", "SecurityGroups": [ { "Fn::GetAtt": [ "SupabaseServicesStorageServiceSecurityGroupDBCF0E7A", "GroupId" ] } ], "Subnets": [ { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" }, { "Ref": "NetworkVpcappSubnet2SubnetC46F4198" } ] } }, "ServiceConnectConfiguration": { "Enabled": true, "Namespace": "bb-appliance.local", "Services": [ { "ClientAliases": [ { "Port": 5000 } ], "DiscoveryName": "storage", "PortName": "storage" } ] }, "ServiceName": "bb-appliance-storage", "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskDefinition": { "Ref": "SupabaseServicesStorageTaskDef5755C94B" } }, "DependsOn": [ "SupabaseServicesStorageTaskDefTaskRoleDefaultPolicyFD0B08BD", "SupabaseServicesStorageTaskDefTaskRoleDBBF54F6" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Storage/Service/Service" } }, "SupabaseServicesStorageServiceSecurityGroupDBCF0E7A": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "BrainbaseAppliance/SupabaseServices/Storage/Service/SecurityGroup", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "SupabaseServicesStorageTaskDefTaskRoleDefaultPolicyFD0B08BD", "SupabaseServicesStorageTaskDefTaskRoleDBBF54F6" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Storage/Service/SecurityGroup/Resource" } }, "SupabaseServicesStorageServiceSecurityGroupfromBrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE865000133D2698": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "Description": "from BrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE86:5000", "FromPort": 5000, "GroupId": { "Fn::GetAtt": [ "SupabaseServicesStorageServiceSecurityGroupDBCF0E7A", "GroupId" ] }, "IpProtocol": "tcp", "SourceSecurityGroupId": { "Fn::GetAtt": [ "SupabaseServicesKongServiceSecurityGroupB4255BEF", "GroupId" ] }, "ToPort": 5000 }, "DependsOn": [ "SupabaseServicesStorageTaskDefTaskRoleDefaultPolicyFD0B08BD", "SupabaseServicesStorageTaskDefTaskRoleDBBF54F6" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Storage/Service/SecurityGroup/from BrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE86:5000" } }, "SupabaseServicesStorageServiceTaskCountTarget519B24A5": { "Type": "AWS::ApplicationAutoScaling::ScalableTarget", "Properties": { "MaxCapacity": 4, "MinCapacity": 1, "ResourceId": { "Fn::Join": [ "", [ "service/", { "Ref": "ClusterEB0386A7" }, "/", { "Fn::GetAtt": [ "SupabaseServicesStorageService10D87C2D", "Name" ] } ] ] }, "RoleARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService" ] ] }, "ScalableDimension": "ecs:service:DesiredCount", "ServiceNamespace": "ecs" }, "DependsOn": [ "SupabaseServicesStorageTaskDefTaskRoleDefaultPolicyFD0B08BD", "SupabaseServicesStorageTaskDefTaskRoleDBBF54F6" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Storage/Service/TaskCount/Target/Resource" } }, "SupabaseServicesStorageServiceTaskCountTargetCpu301275B7": { "Type": "AWS::ApplicationAutoScaling::ScalingPolicy", "Properties": { "PolicyName": "BrainbaseApplianceSupabaseServicesStorageServiceTaskCountTargetCpu797863FA", "PolicyType": "TargetTrackingScaling", "ScalingTargetId": { "Ref": "SupabaseServicesStorageServiceTaskCountTarget519B24A5" }, "TargetTrackingScalingPolicyConfiguration": { "PredefinedMetricSpecification": { "PredefinedMetricType": "ECSServiceAverageCPUUtilization" }, "TargetValue": 60 } }, "DependsOn": [ "SupabaseServicesStorageTaskDefTaskRoleDefaultPolicyFD0B08BD", "SupabaseServicesStorageTaskDefTaskRoleDBBF54F6" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Storage/Service/TaskCount/Target/Cpu/Resource" } }, "SupabaseServicesKongTaskDefTaskRole12A3EA55": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Kong/TaskDef/TaskRole/Resource" } }, "SupabaseServicesKongTaskDef6A780AA9": { "Type": "AWS::ECS::TaskDefinition", "Properties": { "ContainerDefinitions": [ { "Environment": [ { "Name": "KONG_DATABASE", "Value": "off" }, { "Name": "KONG_ANONYMOUS_REPORTS", "Value": "off" }, { "Name": "KONG_DECLARATIVE_CONFIG", "Value": "/usr/local/kong/kong.yml" }, { "Name": "KONG_DNS_ORDER", "Value": "LAST,A,CNAME" }, { "Name": "KONG_DNS_NOT_FOUND_TTL", "Value": "1" }, { "Name": "KONG_DNS_VALID_TTL", "Value": "5" }, { "Name": "KONG_PLUGINS", "Value": "request-transformer,cors,key-auth,acl,request-termination" }, { "Name": "KONG_NGINX_HTTP_CLIENT_HEADER_BUFFER_SIZE", "Value": "64k" }, { "Name": "KONG_NGINX_HTTP_LARGE_CLIENT_HEADER_BUFFERS", "Value": "8 64k" }, { "Name": "KONG_NGINX_PROXY_PROXY_BUFFER_SIZE", "Value": "160k" }, { "Name": "KONG_NGINX_PROXY_PROXY_BUFFERS", "Value": "64 160k" }, { "Name": "KONG_PROXY_ACCESS_LOG", "Value": "/dev/stdout combined" } ], "Essential": true, "Image": "709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-kong:ctx-a189701caacf", "LogConfiguration": { "LogDriver": "awslogs", "Options": { "awslogs-group": { "Ref": "SupabaseServicesKongLogsB862C780" }, "awslogs-stream-prefix": "kong", "awslogs-region": { "Ref": "AWS::Region" } } }, "Name": "app", "PortMappings": [ { "ContainerPort": 8000, "Protocol": "tcp" } ], "Secrets": [ { "Name": "SUPABASE_ANON_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":ANON_KEY::" ] ] } }, { "Name": "SUPABASE_SERVICE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SERVICE_ROLE_KEY::" ] ] } } ] } ], "Cpu": "512", "ExecutionRoleArn": { "Fn::GetAtt": [ "SupabaseServicesKongTaskDefExecutionRoleCE660B3F", "Arn" ] }, "Family": "bb-appliance-kong", "Memory": "1024", "NetworkMode": "awsvpc", "RequiresCompatibilities": [ "FARGATE" ], "RuntimePlatform": { "CpuArchitecture": "ARM64" }, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskRoleArn": { "Fn::GetAtt": [ "SupabaseServicesKongTaskDefTaskRole12A3EA55", "Arn" ] } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Kong/TaskDef/Resource" } }, "SupabaseServicesKongTaskDefExecutionRoleCE660B3F": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Kong/TaskDef/ExecutionRole/Resource" } }, "SupabaseServicesKongTaskDefExecutionRoleDefaultPolicy93DFA9F1": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "SupabaseServicesKongLogsB862C780", "Arn" ] } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } } ], "Version": "2012-10-17" }, "PolicyName": "SupabaseServicesKongTaskDefExecutionRoleDefaultPolicy93DFA9F1", "Roles": [ { "Ref": "SupabaseServicesKongTaskDefExecutionRoleCE660B3F" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Kong/TaskDef/ExecutionRole/DefaultPolicy/Resource" } }, "SupabaseServicesKongLogsB862C780": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": "/bb-appliance/kong", "RetentionInDays": 30, "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ] }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Kong/Logs/Resource" } }, "SupabaseServicesKongService3125E556": { "Type": "AWS::ECS::Service", "Properties": { "Cluster": { "Ref": "ClusterEB0386A7" }, "DeploymentConfiguration": { "Alarms": { "AlarmNames": [], "Enable": false, "Rollback": false }, "DeploymentCircuitBreaker": { "Enable": true, "Rollback": true }, "MaximumPercent": 200, "MinimumHealthyPercent": 50 }, "DeploymentController": { "Type": "ECS" }, "DesiredCount": 1, "EnableECSManagedTags": false, "HealthCheckGracePeriodSeconds": 60, "LaunchType": "FARGATE", "LoadBalancers": [ { "ContainerName": "app", "ContainerPort": 8000, "TargetGroupArn": { "Ref": "SupabaseServicesKongTg01DBFBE7" } } ], "NetworkConfiguration": { "AwsvpcConfiguration": { "AssignPublicIp": "DISABLED", "SecurityGroups": [ { "Fn::GetAtt": [ "SupabaseServicesKongServiceSecurityGroupB4255BEF", "GroupId" ] } ], "Subnets": [ { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" }, { "Ref": "NetworkVpcappSubnet2SubnetC46F4198" } ] } }, "ServiceConnectConfiguration": { "Enabled": true, "Namespace": "bb-appliance.local" }, "ServiceName": "bb-appliance-kong", "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskDefinition": { "Ref": "SupabaseServicesKongTaskDef6A780AA9" } }, "DependsOn": [ "EdgeAlbHttpskongRuleRule91266FBC", "SupabaseServicesAuthService356006B7", "SupabaseServicesKongTaskDefTaskRole12A3EA55", "SupabaseServicesRealtimeService66DA3761", "SupabaseServicesRestService8CB6B129", "SupabaseServicesStorageService10D87C2D" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Kong/Service/Service" } }, "SupabaseServicesKongServiceSecurityGroupB4255BEF": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "BrainbaseAppliance/SupabaseServices/Kong/Service/SecurityGroup", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "SupabaseServicesKongTaskDefTaskRole12A3EA55" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Kong/Service/SecurityGroup/Resource" } }, "SupabaseServicesKongServiceSecurityGroupfromBrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE80006D2C487A": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "Description": "Load balancer to target", "FromPort": 8000, "GroupId": { "Fn::GetAtt": [ "SupabaseServicesKongServiceSecurityGroupB4255BEF", "GroupId" ] }, "IpProtocol": "tcp", "SourceSecurityGroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "ToPort": 8000 }, "DependsOn": [ "SupabaseServicesKongTaskDefTaskRole12A3EA55" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Kong/Service/SecurityGroup/from BrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE:8000" } }, "SupabaseServicesKongServiceTaskCountTargetEEE6E12F": { "Type": "AWS::ApplicationAutoScaling::ScalableTarget", "Properties": { "MaxCapacity": 4, "MinCapacity": 1, "ResourceId": { "Fn::Join": [ "", [ "service/", { "Ref": "ClusterEB0386A7" }, "/", { "Fn::GetAtt": [ "SupabaseServicesKongService3125E556", "Name" ] } ] ] }, "RoleARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService" ] ] }, "ScalableDimension": "ecs:service:DesiredCount", "ServiceNamespace": "ecs" }, "DependsOn": [ "SupabaseServicesKongTaskDefTaskRole12A3EA55" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Kong/Service/TaskCount/Target/Resource" } }, "SupabaseServicesKongServiceTaskCountTargetCpu775A60E1": { "Type": "AWS::ApplicationAutoScaling::ScalingPolicy", "Properties": { "PolicyName": "BrainbaseApplianceSupabaseServicesKongServiceTaskCountTargetCpu7F4C1E70", "PolicyType": "TargetTrackingScaling", "ScalingTargetId": { "Ref": "SupabaseServicesKongServiceTaskCountTargetEEE6E12F" }, "TargetTrackingScalingPolicyConfiguration": { "PredefinedMetricSpecification": { "PredefinedMetricType": "ECSServiceAverageCPUUtilization" }, "TargetValue": 60 } }, "DependsOn": [ "SupabaseServicesKongTaskDefTaskRole12A3EA55" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Kong/Service/TaskCount/Target/Cpu/Resource" } }, "SupabaseServicesKongTg01DBFBE7": { "Type": "AWS::ElasticLoadBalancingV2::TargetGroup", "Properties": { "HealthCheckPath": "/auth/v1/health", "Matcher": { "HttpCode": "200,401" }, "Port": 8000, "Protocol": "HTTP", "Tags": [ { "Key": "bb-appliance-tier", "Value": "supabase-services" }, { "Key": "brainbase-appliance", "Value": "v1" } ], "TargetGroupAttributes": [ { "Key": "deregistration_delay.timeout_seconds", "Value": "15" }, { "Key": "stickiness.enabled", "Value": "false" } ], "TargetType": "ip", "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SupabaseServices/Kong/Tg/Resource" } }, "BaselineBootstrapSg723DC520": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "bb-appliance baseline bootstrap - outbound only", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "PostgresInstanceInstanceProfileC3B11774", "PostgresInstanceEC667DB9", "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/BaselineBootstrap/Sg/Resource" } }, "BaselineBootstrapFunctionServiceRole18B86F8A": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole" ] ] } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "NetworkVpcappSubnet1DefaultRoute579AB742", "NetworkVpcappSubnet1RouteTableAssociationC7D57458", "NetworkVpcappSubnet2DefaultRoute5CF349B1", "NetworkVpcappSubnet2RouteTableAssociationAB6CD379", "PostgresInstanceInstanceProfileC3B11774", "PostgresInstanceEC667DB9", "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/BaselineBootstrap/Function/ServiceRole/Resource" } }, "BaselineBootstrapFunctionServiceRoleDefaultPolicy59C9F130": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "secretsmanager:GetSecretValue", "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } } ], "Version": "2012-10-17" }, "PolicyName": "BaselineBootstrapFunctionServiceRoleDefaultPolicy59C9F130", "Roles": [ { "Ref": "BaselineBootstrapFunctionServiceRole18B86F8A" } ] }, "DependsOn": [ "NetworkVpcappSubnet1DefaultRoute579AB742", "NetworkVpcappSubnet1RouteTableAssociationC7D57458", "NetworkVpcappSubnet2DefaultRoute5CF349B1", "NetworkVpcappSubnet2RouteTableAssociationAB6CD379", "PostgresInstanceInstanceProfileC3B11774", "PostgresInstanceEC667DB9", "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/BaselineBootstrap/Function/ServiceRole/DefaultPolicy/Resource" } }, "BaselineBootstrapFunction93437142": { "Type": "AWS::Lambda::Function", "Properties": { "Architectures": [ "arm64" ], "Code": { "ImageUri": { "Fn::Join": [ "", [ { "Fn::Select": [ 4, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".dkr.ecr.", { "Fn::Select": [ 3, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".", { "Ref": "AWS::URLSuffix" }, "/", { "Ref": "LambdaImageCloneRepositoryE1F8FF7B" }, "@sha256:", { "Fn::GetAtt": [ "LambdaImageClone2364B1C9", "ImageDigestHex" ] } ] ] } }, "ImageConfig": { "Command": [ "baseline-apply/index.handler" ] }, "MemorySize": 512, "PackageType": "Image", "Role": { "Fn::GetAtt": [ "BaselineBootstrapFunctionServiceRole18B86F8A", "Arn" ] }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Timeout": 900, "VpcConfig": { "SecurityGroupIds": [ { "Fn::GetAtt": [ "BaselineBootstrapSg723DC520", "GroupId" ] } ], "SubnetIds": [ { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" }, { "Ref": "NetworkVpcappSubnet2SubnetC46F4198" } ] } }, "DependsOn": [ "BaselineBootstrapFunctionServiceRoleDefaultPolicy59C9F130", "BaselineBootstrapFunctionServiceRole18B86F8A", "NetworkVpcappSubnet1DefaultRoute579AB742", "NetworkVpcappSubnet1RouteTableAssociationC7D57458", "NetworkVpcappSubnet2DefaultRoute5CF349B1", "NetworkVpcappSubnet2RouteTableAssociationAB6CD379", "PostgresInstanceInstanceProfileC3B11774", "PostgresInstanceEC667DB9", "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/BaselineBootstrap/Function/Resource" } }, "BaselineBootstrapFunctionEventInvokeConfigF7A6C244": { "Type": "AWS::Lambda::EventInvokeConfig", "Properties": { "FunctionName": { "Ref": "BaselineBootstrapFunction93437142" }, "MaximumRetryAttempts": 0, "Qualifier": "$LATEST" }, "DependsOn": [ "NetworkVpcappSubnet1DefaultRoute579AB742", "NetworkVpcappSubnet1RouteTableAssociationC7D57458", "NetworkVpcappSubnet2DefaultRoute5CF349B1", "NetworkVpcappSubnet2RouteTableAssociationAB6CD379", "PostgresInstanceInstanceProfileC3B11774", "PostgresInstanceEC667DB9", "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/BaselineBootstrap/Function/EventInvokeConfig/Resource" } }, "BaselineBootstrap8576F676": { "Type": "Custom::BaselineBootstrap", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "BaselineBootstrapFunction93437142", "Arn" ] }, "ServiceTimeout": "2100", "Endpoint": { "Fn::GetAtt": [ "PostgresInstanceEC667DB9", "PrivateDnsName" ] }, "Port": "5432", "DbName": "postgres", "SecretArn": { "Ref": "SupabaseSecretsSecret6D32C82D" }, "Region": { "Ref": "AWS::Region" }, "ManifestDigest": "73f78bbc27552c1fe0349631dd38cc56b17d5fb02f13b9ff719a51896a732329", "MigrationCount": "33", "ReleaseVersion": "2026-09-16.1", "BaselineVersion": "v1", "WaitForTables": "auth.users,storage.objects", "WaitTimeoutSeconds": "300" }, "DependsOn": [ "PostgresInstanceInstanceProfileC3B11774", "PostgresInstanceEC667DB9", "SupabaseSecretsDirectCustomResource5D59AB6E" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/BaselineBootstrap/Resource/Default" } }, "InitialUserFunctionServiceRoleAE73504B": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "BaselineBootstrap8576F676", "EdgeAlbHttpsclientRuleRule5A92A289", "EdgeAlbHttpsconnectorsRuleRule920D4FF8", "EdgeAlbHttpsgithubRuleRuleBE127F5F", "EdgeAlbHttpskongRuleRule91266FBC", "EdgeAlbHttpsllmRuleRule7A1BC9FB", "EdgeAlbHttpsmaswebRuleRule2EF71D65", "EdgeAlbHttpsMasDocsDenyRuleBCB960A3", "EdgeAlbHttpsMasRedocDenyRule501EF5C2", "EdgeAlbHttpsorchestrationRuleRule3E300176", "EdgeAlbHttpsproxyRuleRule7A63DFE1", "EdgeAlbHttps549ABF6F", "EdgeAlbHttpsslackRuleRuleAB98A3F1", "EdgeAlbHttpsWildcardCert195309778", "SupabaseServicesAuthLogs756063FF", "SupabaseServicesAuthServiceSecurityGroupfromBrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE86999966C8E8E3", "SupabaseServicesAuthServiceSecurityGroup90B77866", "SupabaseServicesAuthService356006B7", "SupabaseServicesAuthServiceTaskCountTargetCpu123E324D", "SupabaseServicesAuthServiceTaskCountTarget50FB4C1E", "SupabaseServicesAuthTaskDefExecutionRoleDefaultPolicy1F771EF6", "SupabaseServicesAuthTaskDefExecutionRole87B59333", "SupabaseServicesAuthTaskDef0C561D84", "SupabaseServicesAuthTaskDefTaskRole5BADF343", "SupabaseServicesKongLogsB862C780", "SupabaseServicesKongServiceSecurityGroupfromBrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE80006D2C487A", "SupabaseServicesKongServiceSecurityGroupB4255BEF", "SupabaseServicesKongService3125E556", "SupabaseServicesKongServiceTaskCountTargetCpu775A60E1", "SupabaseServicesKongServiceTaskCountTargetEEE6E12F", "SupabaseServicesKongTaskDefExecutionRoleDefaultPolicy93DFA9F1", "SupabaseServicesKongTaskDefExecutionRoleCE660B3F", "SupabaseServicesKongTaskDef6A780AA9", "SupabaseServicesKongTaskDefTaskRole12A3EA55", "SupabaseServicesKongTg01DBFBE7" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/InitialUser/Function/ServiceRole/Resource" } }, "InitialUserFunctionServiceRoleDefaultPolicy4433ED59": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "secretsmanager:GetSecretValue", "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } } ], "Version": "2012-10-17" }, "PolicyName": "InitialUserFunctionServiceRoleDefaultPolicy4433ED59", "Roles": [ { "Ref": "InitialUserFunctionServiceRoleAE73504B" } ] }, "DependsOn": [ "BaselineBootstrap8576F676", "EdgeAlbHttpsclientRuleRule5A92A289", "EdgeAlbHttpsconnectorsRuleRule920D4FF8", "EdgeAlbHttpsgithubRuleRuleBE127F5F", "EdgeAlbHttpskongRuleRule91266FBC", "EdgeAlbHttpsllmRuleRule7A1BC9FB", "EdgeAlbHttpsmaswebRuleRule2EF71D65", "EdgeAlbHttpsMasDocsDenyRuleBCB960A3", "EdgeAlbHttpsMasRedocDenyRule501EF5C2", "EdgeAlbHttpsorchestrationRuleRule3E300176", "EdgeAlbHttpsproxyRuleRule7A63DFE1", "EdgeAlbHttps549ABF6F", "EdgeAlbHttpsslackRuleRuleAB98A3F1", "EdgeAlbHttpsWildcardCert195309778", "SupabaseServicesAuthLogs756063FF", "SupabaseServicesAuthServiceSecurityGroupfromBrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE86999966C8E8E3", "SupabaseServicesAuthServiceSecurityGroup90B77866", "SupabaseServicesAuthService356006B7", "SupabaseServicesAuthServiceTaskCountTargetCpu123E324D", "SupabaseServicesAuthServiceTaskCountTarget50FB4C1E", "SupabaseServicesAuthTaskDefExecutionRoleDefaultPolicy1F771EF6", "SupabaseServicesAuthTaskDefExecutionRole87B59333", "SupabaseServicesAuthTaskDef0C561D84", "SupabaseServicesAuthTaskDefTaskRole5BADF343", "SupabaseServicesKongLogsB862C780", "SupabaseServicesKongServiceSecurityGroupfromBrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE80006D2C487A", "SupabaseServicesKongServiceSecurityGroupB4255BEF", "SupabaseServicesKongService3125E556", "SupabaseServicesKongServiceTaskCountTargetCpu775A60E1", "SupabaseServicesKongServiceTaskCountTargetEEE6E12F", "SupabaseServicesKongTaskDefExecutionRoleDefaultPolicy93DFA9F1", "SupabaseServicesKongTaskDefExecutionRoleCE660B3F", "SupabaseServicesKongTaskDef6A780AA9", "SupabaseServicesKongTaskDefTaskRole12A3EA55", "SupabaseServicesKongTg01DBFBE7" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/InitialUser/Function/ServiceRole/DefaultPolicy/Resource" } }, "InitialUserFunctionBB18FF23": { "Type": "AWS::Lambda::Function", "Properties": { "Architectures": [ "arm64" ], "Code": { "ImageUri": { "Fn::Join": [ "", [ { "Fn::Select": [ 4, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".dkr.ecr.", { "Fn::Select": [ 3, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".", { "Ref": "AWS::URLSuffix" }, "/", { "Ref": "LambdaImageCloneRepositoryE1F8FF7B" }, "@sha256:", { "Fn::GetAtt": [ "LambdaImageClone2364B1C9", "ImageDigestHex" ] } ] ] } }, "ImageConfig": { "Command": [ "initial-user/index.handler" ] }, "MemorySize": 256, "PackageType": "Image", "Role": { "Fn::GetAtt": [ "InitialUserFunctionServiceRoleAE73504B", "Arn" ] }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Timeout": 240 }, "DependsOn": [ "BaselineBootstrap8576F676", "EdgeAlbHttpsclientRuleRule5A92A289", "EdgeAlbHttpsconnectorsRuleRule920D4FF8", "EdgeAlbHttpsgithubRuleRuleBE127F5F", "EdgeAlbHttpskongRuleRule91266FBC", "EdgeAlbHttpsllmRuleRule7A1BC9FB", "EdgeAlbHttpsmaswebRuleRule2EF71D65", "EdgeAlbHttpsMasDocsDenyRuleBCB960A3", "EdgeAlbHttpsMasRedocDenyRule501EF5C2", "EdgeAlbHttpsorchestrationRuleRule3E300176", "EdgeAlbHttpsproxyRuleRule7A63DFE1", "EdgeAlbHttps549ABF6F", "EdgeAlbHttpsslackRuleRuleAB98A3F1", "EdgeAlbHttpsWildcardCert195309778", "InitialUserFunctionServiceRoleDefaultPolicy4433ED59", "InitialUserFunctionServiceRoleAE73504B", "SupabaseServicesAuthLogs756063FF", "SupabaseServicesAuthServiceSecurityGroupfromBrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE86999966C8E8E3", "SupabaseServicesAuthServiceSecurityGroup90B77866", "SupabaseServicesAuthService356006B7", "SupabaseServicesAuthServiceTaskCountTargetCpu123E324D", "SupabaseServicesAuthServiceTaskCountTarget50FB4C1E", "SupabaseServicesAuthTaskDefExecutionRoleDefaultPolicy1F771EF6", "SupabaseServicesAuthTaskDefExecutionRole87B59333", "SupabaseServicesAuthTaskDef0C561D84", "SupabaseServicesAuthTaskDefTaskRole5BADF343", "SupabaseServicesKongLogsB862C780", "SupabaseServicesKongServiceSecurityGroupfromBrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE80006D2C487A", "SupabaseServicesKongServiceSecurityGroupB4255BEF", "SupabaseServicesKongService3125E556", "SupabaseServicesKongServiceTaskCountTargetCpu775A60E1", "SupabaseServicesKongServiceTaskCountTargetEEE6E12F", "SupabaseServicesKongTaskDefExecutionRoleDefaultPolicy93DFA9F1", "SupabaseServicesKongTaskDefExecutionRoleCE660B3F", "SupabaseServicesKongTaskDef6A780AA9", "SupabaseServicesKongTaskDefTaskRole12A3EA55", "SupabaseServicesKongTg01DBFBE7" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/InitialUser/Function/Resource" } }, "InitialUserFunctionEventInvokeConfigB97C17C4": { "Type": "AWS::Lambda::EventInvokeConfig", "Properties": { "FunctionName": { "Ref": "InitialUserFunctionBB18FF23" }, "MaximumRetryAttempts": 0, "Qualifier": "$LATEST" }, "DependsOn": [ "BaselineBootstrap8576F676", "EdgeAlbHttpsclientRuleRule5A92A289", "EdgeAlbHttpsconnectorsRuleRule920D4FF8", "EdgeAlbHttpsgithubRuleRuleBE127F5F", "EdgeAlbHttpskongRuleRule91266FBC", "EdgeAlbHttpsllmRuleRule7A1BC9FB", "EdgeAlbHttpsmaswebRuleRule2EF71D65", "EdgeAlbHttpsMasDocsDenyRuleBCB960A3", "EdgeAlbHttpsMasRedocDenyRule501EF5C2", "EdgeAlbHttpsorchestrationRuleRule3E300176", "EdgeAlbHttpsproxyRuleRule7A63DFE1", "EdgeAlbHttps549ABF6F", "EdgeAlbHttpsslackRuleRuleAB98A3F1", "EdgeAlbHttpsWildcardCert195309778", "SupabaseServicesAuthLogs756063FF", "SupabaseServicesAuthServiceSecurityGroupfromBrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE86999966C8E8E3", "SupabaseServicesAuthServiceSecurityGroup90B77866", "SupabaseServicesAuthService356006B7", "SupabaseServicesAuthServiceTaskCountTargetCpu123E324D", "SupabaseServicesAuthServiceTaskCountTarget50FB4C1E", "SupabaseServicesAuthTaskDefExecutionRoleDefaultPolicy1F771EF6", "SupabaseServicesAuthTaskDefExecutionRole87B59333", "SupabaseServicesAuthTaskDef0C561D84", "SupabaseServicesAuthTaskDefTaskRole5BADF343", "SupabaseServicesKongLogsB862C780", "SupabaseServicesKongServiceSecurityGroupfromBrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE80006D2C487A", "SupabaseServicesKongServiceSecurityGroupB4255BEF", "SupabaseServicesKongService3125E556", "SupabaseServicesKongServiceTaskCountTargetCpu775A60E1", "SupabaseServicesKongServiceTaskCountTargetEEE6E12F", "SupabaseServicesKongTaskDefExecutionRoleDefaultPolicy93DFA9F1", "SupabaseServicesKongTaskDefExecutionRoleCE660B3F", "SupabaseServicesKongTaskDef6A780AA9", "SupabaseServicesKongTaskDefTaskRole12A3EA55", "SupabaseServicesKongTg01DBFBE7" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/InitialUser/Function/EventInvokeConfig/Resource" } }, "InitialUser8ABF5B70": { "Type": "Custom::InitialUser", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "InitialUserFunctionBB18FF23", "Arn" ] }, "ServiceTimeout": "300", "FirstUserEmail": { "Ref": "FirstUserEmail" }, "DomainName": { "Ref": "DomainName" }, "LoadBalancerDnsName": { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] }, "SecretArn": { "Ref": "SupabaseSecretsSecret6D32C82D" } }, "DependsOn": [ "BaselineBootstrap8576F676", "EdgeAlbHttpsclientRuleRule5A92A289", "EdgeAlbHttpsconnectorsRuleRule920D4FF8", "EdgeAlbHttpsgithubRuleRuleBE127F5F", "EdgeAlbHttpskongRuleRule91266FBC", "EdgeAlbHttpsllmRuleRule7A1BC9FB", "EdgeAlbHttpsmaswebRuleRule2EF71D65", "EdgeAlbHttpsMasDocsDenyRuleBCB960A3", "EdgeAlbHttpsMasRedocDenyRule501EF5C2", "EdgeAlbHttpsorchestrationRuleRule3E300176", "EdgeAlbHttpsproxyRuleRule7A63DFE1", "EdgeAlbHttps549ABF6F", "EdgeAlbHttpsslackRuleRuleAB98A3F1", "EdgeAlbHttpsWildcardCert195309778", "SupabaseServicesAuthLogs756063FF", "SupabaseServicesAuthServiceSecurityGroupfromBrainbaseApplianceSupabaseServicesKongServiceSecurityGroup95DDCE86999966C8E8E3", "SupabaseServicesAuthServiceSecurityGroup90B77866", "SupabaseServicesAuthService356006B7", "SupabaseServicesAuthServiceTaskCountTargetCpu123E324D", "SupabaseServicesAuthServiceTaskCountTarget50FB4C1E", "SupabaseServicesAuthTaskDefExecutionRoleDefaultPolicy1F771EF6", "SupabaseServicesAuthTaskDefExecutionRole87B59333", "SupabaseServicesAuthTaskDef0C561D84", "SupabaseServicesAuthTaskDefTaskRole5BADF343", "SupabaseServicesKongLogsB862C780", "SupabaseServicesKongServiceSecurityGroupfromBrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE80006D2C487A", "SupabaseServicesKongServiceSecurityGroupB4255BEF", "SupabaseServicesKongService3125E556", "SupabaseServicesKongServiceTaskCountTargetCpu775A60E1", "SupabaseServicesKongServiceTaskCountTargetEEE6E12F", "SupabaseServicesKongTaskDefExecutionRoleDefaultPolicy93DFA9F1", "SupabaseServicesKongTaskDefExecutionRoleCE660B3F", "SupabaseServicesKongTaskDef6A780AA9", "SupabaseServicesKongTaskDefTaskRole12A3EA55", "SupabaseServicesKongTg01DBFBE7" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/InitialUser/Resource/Default" } }, "MicroVmImageBootstrapArtifactBucket66DFE7DE": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/MicroVmImageBootstrap/ArtifactBucket/Resource" } }, "MicroVmImageBootstrapArtifactBucketPolicy50DF20FA": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "MicroVmImageBootstrapArtifactBucket66DFE7DE" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "MicroVmImageBootstrapArtifactBucket66DFE7DE", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "MicroVmImageBootstrapArtifactBucket66DFE7DE", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/MicroVmImageBootstrap/ArtifactBucket/Policy/Resource" } }, "MicroVmImageBootstrapBuildRole298D2A22": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Description": "bb-appliance microvm image build - artifact/ECR/logs only", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/MicroVmImageBootstrap/BuildRole/Resource" } }, "MicroVmImageBootstrapBuildRoleDefaultPolicy1B2D540B": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "s3:GetObject", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "MicroVmImageBootstrapArtifactBucket66DFE7DE", "Arn" ] }, "/*" ] ] } }, { "Action": "ecr-public:GetAuthorizationToken", "Effect": "Allow", "Resource": "*" }, { "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group//aws/lambda/microvms/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group//aws/lambda/microvms/*:*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "MicroVmImageBootstrapBuildRoleDefaultPolicy1B2D540B", "Roles": [ { "Ref": "MicroVmImageBootstrapBuildRole298D2A22" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/MicroVmImageBootstrap/BuildRole/DefaultPolicy/Resource" } }, "MicroVmImageBootstrapFunctionServiceRoleA5CB88A7": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/MicroVmImageBootstrap/Function/ServiceRole/Resource" } }, "MicroVmImageBootstrapFunctionServiceRoleDefaultPolicyB3E8DCBB": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "lambda-microvms:CreateMicrovmImage", "lambda-microvms:UpdateMicrovmImage", "lambda-microvms:GetMicrovmImage", "lambda-microvms:ListManagedMicrovmImages", "lambda:CreateMicrovmImage", "lambda:UpdateMicrovmImage", "lambda:GetMicrovmImage", "lambda:ListManagedMicrovmImages" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "s3:PutObject", "s3:DeleteObject" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "MicroVmImageBootstrapArtifactBucket66DFE7DE", "Arn" ] }, "/*" ] ] } }, { "Action": "s3:ListBucket", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "MicroVmImageBootstrapArtifactBucket66DFE7DE", "Arn" ] } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "MicroVmImageBootstrapBuildRole298D2A22", "Arn" ] } }, { "Action": "lambda:PassNetworkConnector", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":lambda:", { "Ref": "AWS::Region" }, ":aws:network-connector:aws-network-connector:INTERNET_EGRESS" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "MicroVmImageBootstrapFunctionServiceRoleDefaultPolicyB3E8DCBB", "Roles": [ { "Ref": "MicroVmImageBootstrapFunctionServiceRoleA5CB88A7" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/MicroVmImageBootstrap/Function/ServiceRole/DefaultPolicy/Resource" } }, "MicroVmImageBootstrapFunction21F8FB35": { "Type": "AWS::Lambda::Function", "Properties": { "Architectures": [ "arm64" ], "Code": { "ImageUri": { "Fn::Join": [ "", [ { "Fn::Select": [ 4, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".dkr.ecr.", { "Fn::Select": [ 3, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".", { "Ref": "AWS::URLSuffix" }, "/", { "Ref": "LambdaImageCloneRepositoryE1F8FF7B" }, "@sha256:", { "Fn::GetAtt": [ "LambdaImageClone2364B1C9", "ImageDigestHex" ] } ] ] } }, "ImageConfig": { "Command": [ "microvm-bootstrap/index.handler" ] }, "MemorySize": 256, "PackageType": "Image", "Role": { "Fn::GetAtt": [ "MicroVmImageBootstrapFunctionServiceRoleA5CB88A7", "Arn" ] }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Timeout": 900 }, "DependsOn": [ "MicroVmImageBootstrapFunctionServiceRoleDefaultPolicyB3E8DCBB", "MicroVmImageBootstrapFunctionServiceRoleA5CB88A7" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/MicroVmImageBootstrap/Function/Resource" } }, "MicroVmImageBootstrapEB7A8E8B": { "Type": "Custom::MicroVmImageBootstrap", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "MicroVmImageBootstrapFunction21F8FB35", "Arn" ] }, "Region": { "Ref": "AWS::Region" }, "ArtifactBucket": { "Ref": "MicroVmImageBootstrapArtifactBucket66DFE7DE" }, "BuildRoleArn": { "Fn::GetAtt": [ "MicroVmImageBootstrapBuildRole298D2A22", "Arn" ] }, "DockerfileBody": "FROM 709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-microvm-acp:sha-e6071f6b5c04-a149816a\nENTRYPOINT [\"python3\",\"/opt/brainbase-shim/bb_microvm_shim.py\"]", "BaseImageFilter": "al2023", "MicroVmImageName": "brainbase-acp-unified-microvm", "HooksJson": "{\"port\":44773,\"microvmImageHooks\":{\"ready\":\"ENABLED\",\"readyTimeoutInSeconds\":300,\"validate\":\"ENABLED\",\"validateTimeoutInSeconds\":300},\"microvmHooks\":{\"run\":\"ENABLED\",\"runTimeoutInSeconds\":60,\"resume\":\"ENABLED\",\"resumeTimeoutInSeconds\":30,\"suspend\":\"ENABLED\",\"suspendTimeoutInSeconds\":30,\"terminate\":\"ENABLED\",\"terminateTimeoutInSeconds\":60}}", "MemoryMiB": "8192", "PollTimeoutSeconds": "600" }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/MicroVmImageBootstrap/Resource/Default" } }, "SesSmtpFeedbackConfigurationSet8B684286": { "Type": "AWS::SES::ConfigurationSet", "Properties": { "ReputationOptions": { "ReputationMetricsEnabled": true }, "SendingOptions": { "SendingEnabled": true }, "SuppressionOptions": { "SuppressedReasons": [ "BOUNCE", "COMPLAINT" ] }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SesSmtp/Feedback/ConfigurationSet/Resource" } }, "SesSmtpFeedbackConfigurationSetFeedbackDF93807D": { "Type": "AWS::SES::ConfigurationSetEventDestination", "Properties": { "ConfigurationSetName": { "Ref": "SesSmtpFeedbackConfigurationSet8B684286" }, "EventDestination": { "Enabled": true, "MatchingEventTypes": [ "bounce", "complaint" ], "SnsDestination": { "TopicARN": { "Ref": "SesSmtpFeedbackTopicEDD74531" } } } }, "DependsOn": [ "SesSmtpFeedbackTopicPolicy5B986CB5", "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SesSmtp/Feedback/ConfigurationSet/Feedback/Resource" } }, "SesSmtpFeedbackTopicEDD74531": { "Type": "AWS::SNS::Topic", "Properties": { "DisplayName": "Brainbase email feedback", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SesSmtp/Feedback/Topic/Resource" } }, "SesSmtpFeedbackTopicTokenSubscription171724A1A": { "Type": "AWS::SNS::Subscription", "Properties": { "Endpoint": { "Ref": "AlarmEmail" }, "Protocol": "email", "TopicArn": { "Ref": "SesSmtpFeedbackTopicEDD74531" } }, "DependsOn": [ "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SesSmtp/Feedback/Topic/TokenSubscription:1/Resource" } }, "SesSmtpFeedbackTopicPolicy5B986CB5": { "Type": "AWS::SNS::TopicPolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sns:Publish", "Condition": { "StringEquals": { "AWS:SourceAccount": { "Ref": "AWS::AccountId" }, "AWS:SourceArn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ses:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":configuration-set/", { "Ref": "SesSmtpFeedbackConfigurationSet8B684286" } ] ] } } }, "Effect": "Allow", "Principal": { "Service": "ses.amazonaws.com" }, "Resource": { "Ref": "SesSmtpFeedbackTopicEDD74531" }, "Sid": "0" }, { "Action": "sns:Publish", "Condition": { "StringEquals": { "aws:SourceAccount": { "Ref": "AWS::AccountId" } }, "ArnEquals": { "aws:SourceArn": { "Fn::GetAtt": [ "SesSmtpFeedbackBounceRateD2D44BDC", "Arn" ] } } }, "Effect": "Allow", "Principal": { "Service": "cloudwatch.amazonaws.com" }, "Resource": { "Ref": "SesSmtpFeedbackTopicEDD74531" }, "Sid": "1" }, { "Action": "sns:Publish", "Condition": { "StringEquals": { "aws:SourceAccount": { "Ref": "AWS::AccountId" } }, "ArnEquals": { "aws:SourceArn": { "Fn::GetAtt": [ "SesSmtpFeedbackComplaintRateDD6FDEFD", "Arn" ] } } }, "Effect": "Allow", "Principal": { "Service": "cloudwatch.amazonaws.com" }, "Resource": { "Ref": "SesSmtpFeedbackTopicEDD74531" }, "Sid": "2" } ], "Version": "2012-10-17" }, "Topics": [ { "Ref": "SesSmtpFeedbackTopicEDD74531" } ] }, "DependsOn": [ "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SesSmtp/Feedback/Topic/Policy/Resource" } }, "SesSmtpFeedbackBounceRateD2D44BDC": { "Type": "AWS::CloudWatch::Alarm", "Properties": { "AlarmActions": [ { "Ref": "SesSmtpFeedbackTopicEDD74531" } ], "AlarmDescription": "Investigate SES feedback using docs/marketplace/customer-onboarding.md. Do not automatically unsuppress recipients.", "ComparisonOperator": "GreaterThanOrEqualToThreshold", "Dimensions": [ { "Name": "ses:configuration-set", "Value": { "Ref": "SesSmtpFeedbackConfigurationSet8B684286" } } ], "EvaluationPeriods": 1, "MetricName": "Reputation.BounceRate", "Namespace": "AWS/SES", "OKActions": [ { "Ref": "SesSmtpFeedbackTopicEDD74531" } ], "Period": 300, "Statistic": "Maximum", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Threshold": 0.03, "TreatMissingData": "ignore" }, "DependsOn": [ "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SesSmtp/Feedback/BounceRate/Resource" } }, "SesSmtpFeedbackComplaintRateDD6FDEFD": { "Type": "AWS::CloudWatch::Alarm", "Properties": { "AlarmActions": [ { "Ref": "SesSmtpFeedbackTopicEDD74531" } ], "AlarmDescription": "Investigate SES feedback using docs/marketplace/customer-onboarding.md. Do not automatically unsuppress recipients.", "ComparisonOperator": "GreaterThanOrEqualToThreshold", "Dimensions": [ { "Name": "ses:configuration-set", "Value": { "Ref": "SesSmtpFeedbackConfigurationSet8B684286" } } ], "EvaluationPeriods": 1, "MetricName": "Reputation.ComplaintRate", "Namespace": "AWS/SES", "OKActions": [ { "Ref": "SesSmtpFeedbackTopicEDD74531" } ], "Period": 300, "Statistic": "Maximum", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Threshold": 0.0005, "TreatMissingData": "ignore" }, "DependsOn": [ "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SesSmtp/Feedback/ComplaintRate/Resource" } }, "SesSmtpIdentity3AB8E9C6": { "Type": "AWS::SES::EmailIdentity", "Properties": { "ConfigurationSetAttributes": { "ConfigurationSetName": { "Ref": "SesSmtpFeedbackConfigurationSet8B684286" } }, "EmailIdentity": { "Ref": "DomainName" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "SesSmtpFeedbackBounceRateD2D44BDC", "SesSmtpFeedbackComplaintRateDD6FDEFD", "SesSmtpFeedbackConfigurationSetFeedbackDF93807D", "SesSmtpFeedbackConfigurationSet8B684286", "SesSmtpFeedbackTopicPolicy5B986CB5", "SesSmtpFeedbackTopicEDD74531", "SesSmtpFeedbackTopicTokenSubscription171724A1A", "SesSmtpSmtpUserDefaultPolicyFC0A5C3B", "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SesSmtp/Identity/Resource" } }, "SesSmtpIdentityDkimDnsToken1D5B114E4": { "Type": "AWS::Route53::RecordSet", "Properties": { "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::GetAtt": [ "SesSmtpIdentity3AB8E9C6", "DkimDNSTokenName1" ] }, "ResourceRecords": [ { "Fn::GetAtt": [ "SesSmtpIdentity3AB8E9C6", "DkimDNSTokenValue1" ] } ], "TTL": "1800", "Type": "CNAME" }, "DependsOn": [ "SesSmtpFeedbackBounceRateD2D44BDC", "SesSmtpFeedbackComplaintRateDD6FDEFD", "SesSmtpFeedbackConfigurationSetFeedbackDF93807D", "SesSmtpFeedbackConfigurationSet8B684286", "SesSmtpFeedbackTopicPolicy5B986CB5", "SesSmtpFeedbackTopicEDD74531", "SesSmtpFeedbackTopicTokenSubscription171724A1A", "SesSmtpSmtpUserDefaultPolicyFC0A5C3B", "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SesSmtp/Identity/DkimDnsToken1" } }, "SesSmtpIdentityDkimDnsToken28CC4D7F3": { "Type": "AWS::Route53::RecordSet", "Properties": { "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::GetAtt": [ "SesSmtpIdentity3AB8E9C6", "DkimDNSTokenName2" ] }, "ResourceRecords": [ { "Fn::GetAtt": [ "SesSmtpIdentity3AB8E9C6", "DkimDNSTokenValue2" ] } ], "TTL": "1800", "Type": "CNAME" }, "DependsOn": [ "SesSmtpFeedbackBounceRateD2D44BDC", "SesSmtpFeedbackComplaintRateDD6FDEFD", "SesSmtpFeedbackConfigurationSetFeedbackDF93807D", "SesSmtpFeedbackConfigurationSet8B684286", "SesSmtpFeedbackTopicPolicy5B986CB5", "SesSmtpFeedbackTopicEDD74531", "SesSmtpFeedbackTopicTokenSubscription171724A1A", "SesSmtpSmtpUserDefaultPolicyFC0A5C3B", "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SesSmtp/Identity/DkimDnsToken2" } }, "SesSmtpIdentityDkimDnsToken3068339BD": { "Type": "AWS::Route53::RecordSet", "Properties": { "HostedZoneId": { "Ref": "HostedZoneId" }, "Name": { "Fn::GetAtt": [ "SesSmtpIdentity3AB8E9C6", "DkimDNSTokenName3" ] }, "ResourceRecords": [ { "Fn::GetAtt": [ "SesSmtpIdentity3AB8E9C6", "DkimDNSTokenValue3" ] } ], "TTL": "1800", "Type": "CNAME" }, "DependsOn": [ "SesSmtpFeedbackBounceRateD2D44BDC", "SesSmtpFeedbackComplaintRateDD6FDEFD", "SesSmtpFeedbackConfigurationSetFeedbackDF93807D", "SesSmtpFeedbackConfigurationSet8B684286", "SesSmtpFeedbackTopicPolicy5B986CB5", "SesSmtpFeedbackTopicEDD74531", "SesSmtpFeedbackTopicTokenSubscription171724A1A", "SesSmtpSmtpUserDefaultPolicyFC0A5C3B", "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SesSmtp/Identity/DkimDnsToken3" } }, "SesSmtpSmtpUser843471B5": { "Type": "AWS::IAM::User", "Properties": { "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SesSmtp/SmtpUser/Resource" } }, "SesSmtpSmtpUserDefaultPolicyFC0A5C3B": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ses:SendEmail", "ses:SendRawEmail" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ses:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":identity/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ses:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":configuration-set/", { "Ref": "SesSmtpFeedbackConfigurationSet8B684286" } ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "SesSmtpSmtpUserDefaultPolicyFC0A5C3B", "Users": [ { "Ref": "SesSmtpSmtpUser843471B5" } ] }, "DependsOn": [ "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SesSmtp/SmtpUser/DefaultPolicy/Resource" } }, "SesSmtpCredFunctionServiceRole2FBD0A15": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SesSmtp/CredFunction/ServiceRole/Resource" } }, "SesSmtpCredFunctionServiceRoleDefaultPolicy30522899": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } }, { "Action": [ "iam:ListAccessKeys", "iam:CreateAccessKey", "iam:DeleteAccessKey" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "SesSmtpSmtpUser843471B5", "Arn" ] } }, { "Action": "cloudformation:DescribeStacks", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stack/BrainbaseAppliance/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "SesSmtpCredFunctionServiceRoleDefaultPolicy30522899", "Roles": [ { "Ref": "SesSmtpCredFunctionServiceRole2FBD0A15" } ] }, "DependsOn": [ "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SesSmtp/CredFunction/ServiceRole/DefaultPolicy/Resource" } }, "SesSmtpCredFunctionAA4A7FBD": { "Type": "AWS::Lambda::Function", "Properties": { "Architectures": [ "arm64" ], "Code": { "ImageUri": { "Fn::Join": [ "", [ { "Fn::Select": [ 4, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".dkr.ecr.", { "Fn::Select": [ 3, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".", { "Ref": "AWS::URLSuffix" }, "/", { "Ref": "LambdaImageCloneRepositoryE1F8FF7B" }, "@sha256:", { "Fn::GetAtt": [ "LambdaImageClone2364B1C9", "ImageDigestHex" ] } ] ] } }, "ImageConfig": { "Command": [ "ses-smtp-cred/index.handler" ] }, "MemorySize": 256, "PackageType": "Image", "Role": { "Fn::GetAtt": [ "SesSmtpCredFunctionServiceRole2FBD0A15", "Arn" ] }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Timeout": 30 }, "DependsOn": [ "SesSmtpCredFunctionServiceRoleDefaultPolicy30522899", "SesSmtpCredFunctionServiceRole2FBD0A15", "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SesSmtp/CredFunction/Resource" } }, "SesSmtpDirectCustomResourceA017E0D6": { "Type": "AWS::CloudFormation::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "SesSmtpCredFunctionAA4A7FBD", "Arn" ] }, "SecretArn": { "Ref": "SupabaseSecretsSecret6D32C82D" }, "UserName": { "Ref": "SesSmtpSmtpUser843471B5" }, "Region": { "Ref": "AWS::Region" }, "SmtpHost": { "Fn::Join": [ "", [ "email-smtp.", { "Ref": "AWS::Region" }, ".amazonaws.com" ] ] }, "SmtpPort": "587", "AdminEmail": { "Fn::Join": [ "", [ "no-reply@", { "Ref": "DomainName" } ] ] }, "SenderName": "Brainbase", "RotationNonce": "1", "KeyInventoryHash": "2ee6fa1774f49d6ee73457b0e5da5a171eb71963d04e456551703ac2c0c272de", "DeleteSemantics": "remove-access-keys" }, "DependsOn": [ "SupabaseSecretsDirectCustomResource5D59AB6E" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/SesSmtp/DirectCustomResource/Default" } }, "WafAppAllowListParam185CA7BF": { "Type": "AWS::WAFv2::IPSet", "Properties": { "Addresses": { "Ref": "AppAllowedCidrs" }, "Description": "Networks allowed to reach the client app host: the AppAllowedCidrs Parameter", "IPAddressVersion": "IPV4", "Scope": "REGIONAL", "Tags": [ { "Key": "bb-appliance-component", "Value": "waf" }, { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Waf/AppAllowListParam" }, "Condition": "AppAllowListProvided" }, "WafWebAclBE24253C": { "Type": "AWS::WAFv2::WebACL", "Properties": { "DefaultAction": { "Allow": {} }, "Name": "bb-appliance-edge", "Rules": [ { "Fn::If": [ "AppAllowListProvided", { "Action": { "Block": { "CustomResponse": { "ResponseCode": 403 } } }, "Name": "AppHostAllowListOnly", "Priority": 0, "Statement": { "AndStatement": { "Statements": [ { "ByteMatchStatement": { "FieldToMatch": { "SingleHeader": { "Name": "host" } }, "PositionalConstraint": "STARTS_WITH", "SearchString": { "Fn::Join": [ "", [ "app.", { "Ref": "DomainName" } ] ] }, "TextTransformations": [ { "Priority": 0, "Type": "LOWERCASE" } ] } }, { "NotStatement": { "Statement": { "IPSetReferenceStatement": { "Arn": { "Fn::GetAtt": [ "WafAppAllowListParam185CA7BF", "Arn" ] } } } } } ] } }, "VisibilityConfig": { "CloudWatchMetricsEnabled": true, "MetricName": "bb-appliance-waf-app-allowlist", "SampledRequestsEnabled": true } }, { "Ref": "AWS::NoValue" } ] }, { "Action": { "Block": { "CustomResponse": { "ResponseCode": 429 } } }, "Name": "AuthRateLimit", "Priority": 10, "Statement": { "RateBasedStatement": { "AggregateKeyType": "IP", "EvaluationWindowSec": 300, "Limit": 300, "ScopeDownStatement": { "ByteMatchStatement": { "FieldToMatch": { "UriPath": {} }, "PositionalConstraint": "STARTS_WITH", "SearchString": "/auth/v1/", "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ] } } } }, "VisibilityConfig": { "CloudWatchMetricsEnabled": true, "MetricName": "bb-appliance-waf-auth-rate", "SampledRequestsEnabled": true } } ], "Scope": "REGIONAL", "Tags": [ { "Key": "bb-appliance-component", "Value": "waf" }, { "Key": "brainbase-appliance", "Value": "v1" } ], "VisibilityConfig": { "CloudWatchMetricsEnabled": true, "MetricName": "bb-appliance-waf", "SampledRequestsEnabled": true } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Waf/WebAcl" } }, "WafAlbAssociationA634B2D5": { "Type": "AWS::WAFv2::WebACLAssociation", "Properties": { "ResourceArn": { "Ref": "EdgeAlb09518372" }, "WebACLArn": { "Fn::GetAtt": [ "WafWebAclBE24253C", "Arn" ] } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Waf/AlbAssociation" } }, "AppSecretsSecretBC39ACDC": { "Type": "AWS::SecretsManager::Secret", "Properties": { "GenerateSecretString": {}, "Name": "bb-appliance/app-shared", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "SupabaseSecretsDirectCustomResource5D59AB6E" ], "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/AppSecrets/Secret/Resource" } }, "AppSecretsKeygenFunctionServiceRole1143F480": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/AppSecrets/KeygenFunction/ServiceRole/Resource" } }, "AppSecretsKeygenFunctionServiceRoleDefaultPolicy7A47F285": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "secretsmanager:PutSecretValue", "secretsmanager:GetSecretValue" ], "Effect": "Allow", "Resource": { "Ref": "AppSecretsSecretBC39ACDC" } }, { "Action": "secretsmanager:GetSecretValue", "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } } ], "Version": "2012-10-17" }, "PolicyName": "AppSecretsKeygenFunctionServiceRoleDefaultPolicy7A47F285", "Roles": [ { "Ref": "AppSecretsKeygenFunctionServiceRole1143F480" } ] }, "DependsOn": [ "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/AppSecrets/KeygenFunction/ServiceRole/DefaultPolicy/Resource" } }, "AppSecretsKeygenFunction61E703BC": { "Type": "AWS::Lambda::Function", "Properties": { "Architectures": [ "arm64" ], "Code": { "ImageUri": { "Fn::Join": [ "", [ { "Fn::Select": [ 4, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".dkr.ecr.", { "Fn::Select": [ 3, { "Fn::Split": [ ":", { "Fn::GetAtt": [ "LambdaImageCloneRepositoryE1F8FF7B", "Arn" ] } ] } ] }, ".", { "Ref": "AWS::URLSuffix" }, "/", { "Ref": "LambdaImageCloneRepositoryE1F8FF7B" }, "@sha256:", { "Fn::GetAtt": [ "LambdaImageClone2364B1C9", "ImageDigestHex" ] } ] ] } }, "ImageConfig": { "Command": [ "app-keygen/index.handler" ] }, "MemorySize": 256, "PackageType": "Image", "Role": { "Fn::GetAtt": [ "AppSecretsKeygenFunctionServiceRole1143F480", "Arn" ] }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Timeout": 30 }, "DependsOn": [ "AppSecretsKeygenFunctionServiceRoleDefaultPolicy7A47F285", "AppSecretsKeygenFunctionServiceRole1143F480", "SupabaseSecretsDirectCustomResource5D59AB6E" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/AppSecrets/KeygenFunction/Resource" } }, "AppSecretsDirectCustomResource73AD5D45": { "Type": "AWS::CloudFormation::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "AppSecretsKeygenFunction61E703BC", "Arn" ] }, "SecretArn": { "Ref": "AppSecretsSecretBC39ACDC" }, "SupabaseSecretArn": { "Ref": "SupabaseSecretsSecret6D32C82D" }, "KeyInventoryHash": "402474e2e7d31ef75535980ec9e879b8c2394beb63d3a62710add8741fd59b90" }, "DependsOn": [ "SupabaseSecretsDirectCustomResource5D59AB6E" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/AppSecrets/DirectCustomResource/Default" } }, "MicrovmResourcesBucketA569B5D3": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "BucketKeyEnabled": true, "ServerSideEncryptionByDefault": { "SSEAlgorithm": "aws:kms" } } ] }, "BucketName": { "Fn::Join": [ "", [ "bb-appliance-microvm-workspaces-", { "Ref": "AWS::AccountId" } ] ] }, "LifecycleConfiguration": { "Rules": [ { "ExpirationInDays": 45, "Id": "ExpireMicrovmWorkspaces", "Prefix": "microvm-workspaces/", "Status": "Enabled" } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/MicrovmResources/Bucket/Resource" } }, "MicrovmResourcesBucketPolicy84990767": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "MicrovmResourcesBucketA569B5D3" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "MicrovmResourcesBucketA569B5D3", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "MicrovmResourcesBucketA569B5D3", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/MicrovmResources/Bucket/Policy/Resource" } }, "LlmServiceTaskDefTaskRole7CEDBDE9": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Llm/Service/TaskDef/TaskRole/Resource" } }, "LlmServiceTaskDefTaskRoleDefaultPolicy0E66CAB7": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "bedrock-mantle:CreateInference", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:bedrock-mantle:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":project/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LlmServiceTaskDefTaskRoleDefaultPolicy0E66CAB7", "Roles": [ { "Ref": "LlmServiceTaskDefTaskRole7CEDBDE9" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Llm/Service/TaskDef/TaskRole/DefaultPolicy/Resource" } }, "LlmServiceTaskDefCFC97A72": { "Type": "AWS::ECS::TaskDefinition", "Properties": { "ContainerDefinitions": [ { "Environment": [ { "Name": "SUPABASE_URL", "Value": { "Fn::Join": [ "", [ "https://supabase.", { "Ref": "DomainName" } ] ] } }, { "Name": "AWS_REGION", "Value": { "Ref": "AWS::Region" } } ], "Essential": true, "Image": "709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-llm-lite:sha-2d8a36bd8f53-1b37f895", "LogConfiguration": { "LogDriver": "awslogs", "Options": { "awslogs-group": { "Ref": "LlmServiceLogsBFDA0631" }, "awslogs-stream-prefix": "llm", "awslogs-region": { "Ref": "AWS::Region" } } }, "Name": "app", "PortMappings": [ { "ContainerPort": 8080, "Protocol": "tcp" } ], "Secrets": [ { "Name": "SUPABASE_SERVICE_ROLE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SERVICE_ROLE_KEY::" ] ] } }, { "Name": "LLM_SERVICE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":LLM_SERVICE_KEY::" ] ] } } ] } ], "Cpu": "512", "ExecutionRoleArn": { "Fn::GetAtt": [ "LlmServiceTaskDefExecutionRoleB48648D9", "Arn" ] }, "Family": "bb-appliance-llm", "Memory": "2048", "NetworkMode": "awsvpc", "RequiresCompatibilities": [ "FARGATE" ], "RuntimePlatform": { "CpuArchitecture": "ARM64" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskRoleArn": { "Fn::GetAtt": [ "LlmServiceTaskDefTaskRole7CEDBDE9", "Arn" ] } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Llm/Service/TaskDef/Resource" } }, "LlmServiceTaskDefExecutionRoleB48648D9": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Llm/Service/TaskDef/ExecutionRole/Resource" } }, "LlmServiceTaskDefExecutionRoleDefaultPolicy701B77D6": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "LlmServiceLogsBFDA0631", "Arn" ] } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "AppSecretsSecretBC39ACDC" } } ], "Version": "2012-10-17" }, "PolicyName": "LlmServiceTaskDefExecutionRoleDefaultPolicy701B77D6", "Roles": [ { "Ref": "LlmServiceTaskDefExecutionRoleB48648D9" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Llm/Service/TaskDef/ExecutionRole/DefaultPolicy/Resource" } }, "LlmServiceLogsBFDA0631": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": "/bb-appliance/llm", "RetentionInDays": 30, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Llm/Service/Logs/Resource" } }, "LlmService78649CC1": { "Type": "AWS::ECS::Service", "Properties": { "Cluster": { "Ref": "ClusterEB0386A7" }, "DeploymentConfiguration": { "Alarms": { "AlarmNames": [], "Enable": false, "Rollback": false }, "DeploymentCircuitBreaker": { "Enable": true, "Rollback": true }, "MaximumPercent": 200, "MinimumHealthyPercent": 50 }, "DeploymentController": { "Type": "ECS" }, "DesiredCount": 1, "EnableECSManagedTags": false, "HealthCheckGracePeriodSeconds": 60, "LaunchType": "FARGATE", "LoadBalancers": [ { "ContainerName": "app", "ContainerPort": 8080, "TargetGroupArn": { "Ref": "LlmServiceTgB268E376" } } ], "NetworkConfiguration": { "AwsvpcConfiguration": { "AssignPublicIp": "DISABLED", "SecurityGroups": [ { "Fn::GetAtt": [ "LlmServiceSecurityGroup0146E616", "GroupId" ] } ], "Subnets": [ { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" }, { "Ref": "NetworkVpcappSubnet2SubnetC46F4198" } ] } }, "ServiceName": "bb-appliance-llm", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskDefinition": { "Ref": "LlmServiceTaskDefCFC97A72" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "EdgeAlbHttpsllmRuleRule7A1BC9FB", "LlmServiceTaskDefTaskRoleDefaultPolicy0E66CAB7", "LlmServiceTaskDefTaskRole7CEDBDE9" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Llm/Service/Service/Service" } }, "LlmServiceSecurityGroup0146E616": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "BrainbaseAppliance/Llm/Service/Service/SecurityGroup", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "LlmServiceTaskDefTaskRoleDefaultPolicy0E66CAB7", "LlmServiceTaskDefTaskRole7CEDBDE9" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Llm/Service/Service/SecurityGroup/Resource" } }, "LlmServiceSecurityGroupfromBrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE8080DFFA386C": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "Description": "Load balancer to target", "FromPort": 8080, "GroupId": { "Fn::GetAtt": [ "LlmServiceSecurityGroup0146E616", "GroupId" ] }, "IpProtocol": "tcp", "SourceSecurityGroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "ToPort": 8080 }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "LlmServiceTaskDefTaskRoleDefaultPolicy0E66CAB7", "LlmServiceTaskDefTaskRole7CEDBDE9" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Llm/Service/Service/SecurityGroup/from BrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE:8080" } }, "LlmServiceTaskCountTargetFB69EA4D": { "Type": "AWS::ApplicationAutoScaling::ScalableTarget", "Properties": { "MaxCapacity": 4, "MinCapacity": 1, "ResourceId": { "Fn::Join": [ "", [ "service/", { "Ref": "ClusterEB0386A7" }, "/", { "Fn::GetAtt": [ "LlmService78649CC1", "Name" ] } ] ] }, "RoleARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService" ] ] }, "ScalableDimension": "ecs:service:DesiredCount", "ServiceNamespace": "ecs" }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "LlmServiceTaskDefTaskRoleDefaultPolicy0E66CAB7", "LlmServiceTaskDefTaskRole7CEDBDE9" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Llm/Service/Service/TaskCount/Target/Resource" } }, "LlmServiceTaskCountTargetRequestCountF1633506": { "Type": "AWS::ApplicationAutoScaling::ScalingPolicy", "Properties": { "PolicyName": "BrainbaseApplianceLlmServiceTaskCountTargetRequestCount5E4E3344", "PolicyType": "TargetTrackingScaling", "ScalingTargetId": { "Ref": "LlmServiceTaskCountTargetFB69EA4D" }, "TargetTrackingScalingPolicyConfiguration": { "PredefinedMetricSpecification": { "PredefinedMetricType": "ALBRequestCountPerTarget", "ResourceLabel": { "Fn::Join": [ "", [ { "Fn::Select": [ 1, { "Fn::Split": [ "/", { "Ref": "EdgeAlbHttps549ABF6F" } ] } ] }, "/", { "Fn::Select": [ 2, { "Fn::Split": [ "/", { "Ref": "EdgeAlbHttps549ABF6F" } ] } ] }, "/", { "Fn::Select": [ 3, { "Fn::Split": [ "/", { "Ref": "EdgeAlbHttps549ABF6F" } ] } ] }, "/", { "Fn::GetAtt": [ "LlmServiceTgB268E376", "TargetGroupFullName" ] } ] ] } }, "TargetValue": 100 } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "LlmServiceTaskDefTaskRoleDefaultPolicy0E66CAB7", "LlmServiceTaskDefTaskRole7CEDBDE9" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Llm/Service/Service/TaskCount/Target/RequestCount/Resource" } }, "LlmServiceTgB268E376": { "Type": "AWS::ElasticLoadBalancingV2::TargetGroup", "Properties": { "HealthCheckPath": "/healthz", "Port": 8080, "Protocol": "HTTP", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TargetGroupAttributes": [ { "Key": "deregistration_delay.timeout_seconds", "Value": "15" }, { "Key": "stickiness.enabled", "Value": "false" } ], "TargetType": "ip", "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Llm/Service/Tg/Resource" } }, "McpsOrchestrationTaskDefTaskRole93111EC8": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Orchestration/TaskDef/TaskRole/Resource" } }, "McpsOrchestrationTaskDef458B1ADC": { "Type": "AWS::ECS::TaskDefinition", "Properties": { "ContainerDefinitions": [ { "Environment": [ { "Name": "MCP_AUTH_ISSUER", "Value": "https://app.brainbaselabs.com" }, { "Name": "SUPABASE_URL", "Value": { "Fn::Join": [ "", [ "https://supabase.", { "Ref": "DomainName" } ] ] } }, { "Name": "SUPABASE_JWT_AUDIENCE", "Value": "authenticated" }, { "Name": "PUBLIC_BASE_URL", "Value": { "Fn::Join": [ "", [ "https://orchestration.", { "Ref": "DomainName" } ] ] } }, { "Name": "MANAGED_AGENTS_URL", "Value": { "Fn::Join": [ "", [ "https://api.", { "Ref": "DomainName" } ] ] } }, { "Name": "KAFKA_LLM_SERVICE_URL", "Value": { "Fn::Join": [ "", [ "https://llm.", { "Ref": "DomainName" } ] ] } } ], "Essential": true, "Image": "709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-mcp-orchestration:sha-d13e1d940891", "LogConfiguration": { "LogDriver": "awslogs", "Options": { "awslogs-group": { "Ref": "McpsOrchestrationLogsB92E0D28" }, "awslogs-stream-prefix": "orchestration", "awslogs-region": { "Ref": "AWS::Region" } } }, "Name": "app", "PortMappings": [ { "ContainerPort": 8777, "Protocol": "tcp" } ], "Secrets": [ { "Name": "SUPABASE_SERVICE_ROLE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SERVICE_ROLE_KEY::" ] ] } }, { "Name": "SUPABASE_JWT_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":JWT_SECRET::" ] ] } }, { "Name": "MCP_AUTH_SHARED_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":MCP_AUTH_SHARED_SECRET::" ] ] } }, { "Name": "LLM_SERVICE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":LLM_SERVICE_KEY::" ] ] } } ] } ], "Cpu": "256", "ExecutionRoleArn": { "Fn::GetAtt": [ "McpsOrchestrationTaskDefExecutionRole350E34BF", "Arn" ] }, "Family": "bb-appliance-orchestration", "Memory": "1024", "NetworkMode": "awsvpc", "RequiresCompatibilities": [ "FARGATE" ], "RuntimePlatform": { "CpuArchitecture": "ARM64" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskRoleArn": { "Fn::GetAtt": [ "McpsOrchestrationTaskDefTaskRole93111EC8", "Arn" ] } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Orchestration/TaskDef/Resource" } }, "McpsOrchestrationTaskDefExecutionRole350E34BF": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Orchestration/TaskDef/ExecutionRole/Resource" } }, "McpsOrchestrationTaskDefExecutionRoleDefaultPolicy6C86181C": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "McpsOrchestrationLogsB92E0D28", "Arn" ] } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "AppSecretsSecretBC39ACDC" } } ], "Version": "2012-10-17" }, "PolicyName": "McpsOrchestrationTaskDefExecutionRoleDefaultPolicy6C86181C", "Roles": [ { "Ref": "McpsOrchestrationTaskDefExecutionRole350E34BF" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Orchestration/TaskDef/ExecutionRole/DefaultPolicy/Resource" } }, "McpsOrchestrationLogsB92E0D28": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": "/bb-appliance/orchestration", "RetentionInDays": 30, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Orchestration/Logs/Resource" } }, "McpsOrchestrationServiceE560A0E4": { "Type": "AWS::ECS::Service", "Properties": { "Cluster": { "Ref": "ClusterEB0386A7" }, "DeploymentConfiguration": { "Alarms": { "AlarmNames": [], "Enable": false, "Rollback": false }, "DeploymentCircuitBreaker": { "Enable": true, "Rollback": true }, "MaximumPercent": 200, "MinimumHealthyPercent": 50 }, "DeploymentController": { "Type": "ECS" }, "DesiredCount": 1, "EnableECSManagedTags": false, "HealthCheckGracePeriodSeconds": 60, "LaunchType": "FARGATE", "LoadBalancers": [ { "ContainerName": "app", "ContainerPort": 8777, "TargetGroupArn": { "Ref": "McpsOrchestrationTgAD39B9C3" } } ], "NetworkConfiguration": { "AwsvpcConfiguration": { "AssignPublicIp": "DISABLED", "SecurityGroups": [ { "Fn::GetAtt": [ "McpsOrchestrationServiceSecurityGroup47C00585", "GroupId" ] } ], "Subnets": [ { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" }, { "Ref": "NetworkVpcappSubnet2SubnetC46F4198" } ] } }, "ServiceName": "bb-appliance-orchestration", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskDefinition": { "Ref": "McpsOrchestrationTaskDef458B1ADC" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "EdgeAlbHttpsorchestrationRuleRule3E300176", "McpsOrchestrationTaskDefTaskRole93111EC8" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Orchestration/Service/Service" } }, "McpsOrchestrationServiceSecurityGroup47C00585": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "BrainbaseAppliance/Mcps/Orchestration/Service/SecurityGroup", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "McpsOrchestrationTaskDefTaskRole93111EC8" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Orchestration/Service/SecurityGroup/Resource" } }, "McpsOrchestrationServiceSecurityGroupfromBrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE87772DD24BB8": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "Description": "Load balancer to target", "FromPort": 8777, "GroupId": { "Fn::GetAtt": [ "McpsOrchestrationServiceSecurityGroup47C00585", "GroupId" ] }, "IpProtocol": "tcp", "SourceSecurityGroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "ToPort": 8777 }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "McpsOrchestrationTaskDefTaskRole93111EC8" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Orchestration/Service/SecurityGroup/from BrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE:8777" } }, "McpsOrchestrationServiceTaskCountTarget5EE19AC7": { "Type": "AWS::ApplicationAutoScaling::ScalableTarget", "Properties": { "MaxCapacity": 4, "MinCapacity": 1, "ResourceId": { "Fn::Join": [ "", [ "service/", { "Ref": "ClusterEB0386A7" }, "/", { "Fn::GetAtt": [ "McpsOrchestrationServiceE560A0E4", "Name" ] } ] ] }, "RoleARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService" ] ] }, "ScalableDimension": "ecs:service:DesiredCount", "ServiceNamespace": "ecs" }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "McpsOrchestrationTaskDefTaskRole93111EC8" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Orchestration/Service/TaskCount/Target/Resource" } }, "McpsOrchestrationServiceTaskCountTargetCpu53334277": { "Type": "AWS::ApplicationAutoScaling::ScalingPolicy", "Properties": { "PolicyName": "BrainbaseApplianceMcpsOrchestrationServiceTaskCountTargetCpuA4A1FE9A", "PolicyType": "TargetTrackingScaling", "ScalingTargetId": { "Ref": "McpsOrchestrationServiceTaskCountTarget5EE19AC7" }, "TargetTrackingScalingPolicyConfiguration": { "PredefinedMetricSpecification": { "PredefinedMetricType": "ECSServiceAverageCPUUtilization" }, "TargetValue": 60 } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "McpsOrchestrationTaskDefTaskRole93111EC8" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Orchestration/Service/TaskCount/Target/Cpu/Resource" } }, "McpsOrchestrationTgAD39B9C3": { "Type": "AWS::ElasticLoadBalancingV2::TargetGroup", "Properties": { "HealthCheckPath": "/healthz", "Port": 8777, "Protocol": "HTTP", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TargetGroupAttributes": [ { "Key": "deregistration_delay.timeout_seconds", "Value": "15" }, { "Key": "stickiness.enabled", "Value": "false" } ], "TargetType": "ip", "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Orchestration/Tg/Resource" } }, "McpsGithubTaskDefTaskRole573B5A1C": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Github/TaskDef/TaskRole/Resource" } }, "McpsGithubTaskDef4B0D7BBB": { "Type": "AWS::ECS::TaskDefinition", "Properties": { "ContainerDefinitions": [ { "Environment": [ { "Name": "MCP_AUTH_ISSUER", "Value": "https://app.brainbaselabs.com" }, { "Name": "SUPABASE_URL", "Value": { "Fn::Join": [ "", [ "https://supabase.", { "Ref": "DomainName" } ] ] } }, { "Name": "SUPABASE_JWT_AUDIENCE", "Value": "authenticated" }, { "Name": "PUBLIC_BASE_URL", "Value": { "Fn::Join": [ "", [ "https://github.", { "Ref": "DomainName" } ] ] } } ], "Essential": true, "Image": "709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-mcp-github:sha-d13e1d940891", "LogConfiguration": { "LogDriver": "awslogs", "Options": { "awslogs-group": { "Ref": "McpsGithubLogsD2F7B771" }, "awslogs-stream-prefix": "github", "awslogs-region": { "Ref": "AWS::Region" } } }, "Name": "app", "PortMappings": [ { "ContainerPort": 8778, "Protocol": "tcp" } ], "Secrets": [ { "Name": "SUPABASE_SERVICE_ROLE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SERVICE_ROLE_KEY::" ] ] } }, { "Name": "SUPABASE_JWT_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":JWT_SECRET::" ] ] } }, { "Name": "MCP_AUTH_SHARED_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":MCP_AUTH_SHARED_SECRET::" ] ] } }, { "Name": "BRAINBASE_GITHUB_DATA_KEY_V1", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":BRAINBASE_GITHUB_DATA_KEY_V1::" ] ] } } ] } ], "Cpu": "256", "ExecutionRoleArn": { "Fn::GetAtt": [ "McpsGithubTaskDefExecutionRole6951393D", "Arn" ] }, "Family": "bb-appliance-github", "Memory": "1024", "NetworkMode": "awsvpc", "RequiresCompatibilities": [ "FARGATE" ], "RuntimePlatform": { "CpuArchitecture": "ARM64" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskRoleArn": { "Fn::GetAtt": [ "McpsGithubTaskDefTaskRole573B5A1C", "Arn" ] } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Github/TaskDef/Resource" } }, "McpsGithubTaskDefExecutionRole6951393D": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Github/TaskDef/ExecutionRole/Resource" } }, "McpsGithubTaskDefExecutionRoleDefaultPolicy24798CFE": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "McpsGithubLogsD2F7B771", "Arn" ] } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "AppSecretsSecretBC39ACDC" } } ], "Version": "2012-10-17" }, "PolicyName": "McpsGithubTaskDefExecutionRoleDefaultPolicy24798CFE", "Roles": [ { "Ref": "McpsGithubTaskDefExecutionRole6951393D" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Github/TaskDef/ExecutionRole/DefaultPolicy/Resource" } }, "McpsGithubLogsD2F7B771": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": "/bb-appliance/github", "RetentionInDays": 30, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Github/Logs/Resource" } }, "McpsGithubService6442E4CC": { "Type": "AWS::ECS::Service", "Properties": { "Cluster": { "Ref": "ClusterEB0386A7" }, "DeploymentConfiguration": { "Alarms": { "AlarmNames": [], "Enable": false, "Rollback": false }, "DeploymentCircuitBreaker": { "Enable": true, "Rollback": true }, "MaximumPercent": 200, "MinimumHealthyPercent": 50 }, "DeploymentController": { "Type": "ECS" }, "DesiredCount": 1, "EnableECSManagedTags": false, "HealthCheckGracePeriodSeconds": 60, "LaunchType": "FARGATE", "LoadBalancers": [ { "ContainerName": "app", "ContainerPort": 8778, "TargetGroupArn": { "Ref": "McpsGithubTg3B03757B" } } ], "NetworkConfiguration": { "AwsvpcConfiguration": { "AssignPublicIp": "DISABLED", "SecurityGroups": [ { "Fn::GetAtt": [ "McpsGithubServiceSecurityGroup0DE447E1", "GroupId" ] } ], "Subnets": [ { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" }, { "Ref": "NetworkVpcappSubnet2SubnetC46F4198" } ] } }, "ServiceName": "bb-appliance-github", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskDefinition": { "Ref": "McpsGithubTaskDef4B0D7BBB" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "EdgeAlbHttpsgithubRuleRuleBE127F5F", "McpsGithubTaskDefTaskRole573B5A1C" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Github/Service/Service" } }, "McpsGithubServiceSecurityGroup0DE447E1": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "BrainbaseAppliance/Mcps/Github/Service/SecurityGroup", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "McpsGithubTaskDefTaskRole573B5A1C" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Github/Service/SecurityGroup/Resource" } }, "McpsGithubServiceSecurityGroupfromBrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE8778C9D14768": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "Description": "Load balancer to target", "FromPort": 8778, "GroupId": { "Fn::GetAtt": [ "McpsGithubServiceSecurityGroup0DE447E1", "GroupId" ] }, "IpProtocol": "tcp", "SourceSecurityGroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "ToPort": 8778 }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "McpsGithubTaskDefTaskRole573B5A1C" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Github/Service/SecurityGroup/from BrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE:8778" } }, "McpsGithubServiceTaskCountTargetDEDF3F2C": { "Type": "AWS::ApplicationAutoScaling::ScalableTarget", "Properties": { "MaxCapacity": 4, "MinCapacity": 1, "ResourceId": { "Fn::Join": [ "", [ "service/", { "Ref": "ClusterEB0386A7" }, "/", { "Fn::GetAtt": [ "McpsGithubService6442E4CC", "Name" ] } ] ] }, "RoleARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService" ] ] }, "ScalableDimension": "ecs:service:DesiredCount", "ServiceNamespace": "ecs" }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "McpsGithubTaskDefTaskRole573B5A1C" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Github/Service/TaskCount/Target/Resource" } }, "McpsGithubServiceTaskCountTargetCpu2E7D247D": { "Type": "AWS::ApplicationAutoScaling::ScalingPolicy", "Properties": { "PolicyName": "BrainbaseApplianceMcpsGithubServiceTaskCountTargetCpu70611C56", "PolicyType": "TargetTrackingScaling", "ScalingTargetId": { "Ref": "McpsGithubServiceTaskCountTargetDEDF3F2C" }, "TargetTrackingScalingPolicyConfiguration": { "PredefinedMetricSpecification": { "PredefinedMetricType": "ECSServiceAverageCPUUtilization" }, "TargetValue": 60 } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "McpsGithubTaskDefTaskRole573B5A1C" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Github/Service/TaskCount/Target/Cpu/Resource" } }, "McpsGithubTg3B03757B": { "Type": "AWS::ElasticLoadBalancingV2::TargetGroup", "Properties": { "HealthCheckPath": "/healthz", "Port": 8778, "Protocol": "HTTP", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TargetGroupAttributes": [ { "Key": "deregistration_delay.timeout_seconds", "Value": "15" }, { "Key": "stickiness.enabled", "Value": "false" } ], "TargetType": "ip", "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Github/Tg/Resource" } }, "McpsSlackTaskDefTaskRole7A263752": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Slack/TaskDef/TaskRole/Resource" } }, "McpsSlackTaskDef175CB312": { "Type": "AWS::ECS::TaskDefinition", "Properties": { "ContainerDefinitions": [ { "Environment": [ { "Name": "MCP_AUTH_ISSUER", "Value": "https://app.brainbaselabs.com" }, { "Name": "SUPABASE_URL", "Value": { "Fn::Join": [ "", [ "https://supabase.", { "Ref": "DomainName" } ] ] } }, { "Name": "SUPABASE_JWT_AUDIENCE", "Value": "authenticated" }, { "Name": "PUBLIC_BASE_URL", "Value": { "Fn::Join": [ "", [ "https://slack.", { "Ref": "DomainName" } ] ] } }, { "Name": "LLM_SERVICE_URL", "Value": { "Fn::Join": [ "", [ "https://llm.", { "Ref": "DomainName" } ] ] } } ], "Essential": true, "Image": "709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-mcp-slack:sha-d13e1d940891", "LogConfiguration": { "LogDriver": "awslogs", "Options": { "awslogs-group": { "Ref": "McpsSlackLogs57247B30" }, "awslogs-stream-prefix": "slack", "awslogs-region": { "Ref": "AWS::Region" } } }, "Name": "app", "PortMappings": [ { "ContainerPort": 8777, "Protocol": "tcp" } ], "Secrets": [ { "Name": "SUPABASE_SERVICE_ROLE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SERVICE_ROLE_KEY::" ] ] } }, { "Name": "SUPABASE_JWT_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":JWT_SECRET::" ] ] } }, { "Name": "MCP_AUTH_SHARED_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":MCP_AUTH_SHARED_SECRET::" ] ] } }, { "Name": "LLM_SERVICE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":LLM_SERVICE_KEY::" ] ] } } ] } ], "Cpu": "256", "ExecutionRoleArn": { "Fn::GetAtt": [ "McpsSlackTaskDefExecutionRole992138D6", "Arn" ] }, "Family": "bb-appliance-slack", "Memory": "1024", "NetworkMode": "awsvpc", "RequiresCompatibilities": [ "FARGATE" ], "RuntimePlatform": { "CpuArchitecture": "ARM64" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskRoleArn": { "Fn::GetAtt": [ "McpsSlackTaskDefTaskRole7A263752", "Arn" ] } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Slack/TaskDef/Resource" } }, "McpsSlackTaskDefExecutionRole992138D6": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Slack/TaskDef/ExecutionRole/Resource" } }, "McpsSlackTaskDefExecutionRoleDefaultPolicy5949B997": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "McpsSlackLogs57247B30", "Arn" ] } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "AppSecretsSecretBC39ACDC" } } ], "Version": "2012-10-17" }, "PolicyName": "McpsSlackTaskDefExecutionRoleDefaultPolicy5949B997", "Roles": [ { "Ref": "McpsSlackTaskDefExecutionRole992138D6" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Slack/TaskDef/ExecutionRole/DefaultPolicy/Resource" } }, "McpsSlackLogs57247B30": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": "/bb-appliance/slack", "RetentionInDays": 30, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Slack/Logs/Resource" } }, "McpsSlackServiceAAA27EF2": { "Type": "AWS::ECS::Service", "Properties": { "Cluster": { "Ref": "ClusterEB0386A7" }, "DeploymentConfiguration": { "Alarms": { "AlarmNames": [], "Enable": false, "Rollback": false }, "DeploymentCircuitBreaker": { "Enable": true, "Rollback": true }, "MaximumPercent": 200, "MinimumHealthyPercent": 50 }, "DeploymentController": { "Type": "ECS" }, "DesiredCount": 1, "EnableECSManagedTags": false, "HealthCheckGracePeriodSeconds": 60, "LaunchType": "FARGATE", "LoadBalancers": [ { "ContainerName": "app", "ContainerPort": 8777, "TargetGroupArn": { "Ref": "McpsSlackTgC65FACB6" } } ], "NetworkConfiguration": { "AwsvpcConfiguration": { "AssignPublicIp": "DISABLED", "SecurityGroups": [ { "Fn::GetAtt": [ "McpsSlackServiceSecurityGroupA0EB7CCB", "GroupId" ] } ], "Subnets": [ { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" }, { "Ref": "NetworkVpcappSubnet2SubnetC46F4198" } ] } }, "ServiceName": "bb-appliance-slack", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskDefinition": { "Ref": "McpsSlackTaskDef175CB312" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "EdgeAlbHttpsslackRuleRuleAB98A3F1", "McpsSlackTaskDefTaskRole7A263752" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Slack/Service/Service" } }, "McpsSlackServiceSecurityGroupA0EB7CCB": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "BrainbaseAppliance/Mcps/Slack/Service/SecurityGroup", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "McpsSlackTaskDefTaskRole7A263752" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Slack/Service/SecurityGroup/Resource" } }, "McpsSlackServiceSecurityGroupfromBrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE8777983D0AC1": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "Description": "Load balancer to target", "FromPort": 8777, "GroupId": { "Fn::GetAtt": [ "McpsSlackServiceSecurityGroupA0EB7CCB", "GroupId" ] }, "IpProtocol": "tcp", "SourceSecurityGroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "ToPort": 8777 }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "McpsSlackTaskDefTaskRole7A263752" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Slack/Service/SecurityGroup/from BrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE:8777" } }, "McpsSlackServiceTaskCountTarget440E54A4": { "Type": "AWS::ApplicationAutoScaling::ScalableTarget", "Properties": { "MaxCapacity": 4, "MinCapacity": 1, "ResourceId": { "Fn::Join": [ "", [ "service/", { "Ref": "ClusterEB0386A7" }, "/", { "Fn::GetAtt": [ "McpsSlackServiceAAA27EF2", "Name" ] } ] ] }, "RoleARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService" ] ] }, "ScalableDimension": "ecs:service:DesiredCount", "ServiceNamespace": "ecs" }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "McpsSlackTaskDefTaskRole7A263752" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Slack/Service/TaskCount/Target/Resource" } }, "McpsSlackServiceTaskCountTargetCpu0D899EAA": { "Type": "AWS::ApplicationAutoScaling::ScalingPolicy", "Properties": { "PolicyName": "BrainbaseApplianceMcpsSlackServiceTaskCountTargetCpu14BC2D19", "PolicyType": "TargetTrackingScaling", "ScalingTargetId": { "Ref": "McpsSlackServiceTaskCountTarget440E54A4" }, "TargetTrackingScalingPolicyConfiguration": { "PredefinedMetricSpecification": { "PredefinedMetricType": "ECSServiceAverageCPUUtilization" }, "TargetValue": 60 } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "McpsSlackTaskDefTaskRole7A263752" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Slack/Service/TaskCount/Target/Cpu/Resource" } }, "McpsSlackTgC65FACB6": { "Type": "AWS::ElasticLoadBalancingV2::TargetGroup", "Properties": { "HealthCheckPath": "/healthz", "Port": 8777, "Protocol": "HTTP", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TargetGroupAttributes": [ { "Key": "deregistration_delay.timeout_seconds", "Value": "15" }, { "Key": "stickiness.enabled", "Value": "false" } ], "TargetType": "ip", "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Slack/Tg/Resource" } }, "McpsProxyTaskDefTaskRole8BDDB3C6": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Proxy/TaskDef/TaskRole/Resource" } }, "McpsProxyTaskDef9DB70E9A": { "Type": "AWS::ECS::TaskDefinition", "Properties": { "ContainerDefinitions": [ { "Environment": [ { "Name": "MCP_AUTH_ISSUER", "Value": "https://app.brainbaselabs.com" }, { "Name": "SUPABASE_URL", "Value": { "Fn::Join": [ "", [ "https://supabase.", { "Ref": "DomainName" } ] ] } }, { "Name": "SUPABASE_JWT_AUDIENCE", "Value": "authenticated" }, { "Name": "PUBLIC_BASE_URL", "Value": { "Fn::Join": [ "", [ "https://proxy.", { "Ref": "DomainName" } ] ] } } ], "Essential": true, "Image": "709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-mcp-proxy:sha-d13e1d940891", "LogConfiguration": { "LogDriver": "awslogs", "Options": { "awslogs-group": { "Ref": "McpsProxyLogsE57B5A43" }, "awslogs-stream-prefix": "proxy", "awslogs-region": { "Ref": "AWS::Region" } } }, "Name": "app", "PortMappings": [ { "ContainerPort": 8777, "Protocol": "tcp" } ], "Secrets": [ { "Name": "SUPABASE_SERVICE_ROLE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SERVICE_ROLE_KEY::" ] ] } }, { "Name": "SUPABASE_JWT_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":JWT_SECRET::" ] ] } }, { "Name": "MCP_AUTH_SHARED_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":MCP_AUTH_SHARED_SECRET::" ] ] } } ] } ], "Cpu": "256", "ExecutionRoleArn": { "Fn::GetAtt": [ "McpsProxyTaskDefExecutionRole25847ADA", "Arn" ] }, "Family": "bb-appliance-proxy", "Memory": "1024", "NetworkMode": "awsvpc", "RequiresCompatibilities": [ "FARGATE" ], "RuntimePlatform": { "CpuArchitecture": "ARM64" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskRoleArn": { "Fn::GetAtt": [ "McpsProxyTaskDefTaskRole8BDDB3C6", "Arn" ] } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Proxy/TaskDef/Resource" } }, "McpsProxyTaskDefExecutionRole25847ADA": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Proxy/TaskDef/ExecutionRole/Resource" } }, "McpsProxyTaskDefExecutionRoleDefaultPolicy3442DFF1": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "McpsProxyLogsE57B5A43", "Arn" ] } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "AppSecretsSecretBC39ACDC" } } ], "Version": "2012-10-17" }, "PolicyName": "McpsProxyTaskDefExecutionRoleDefaultPolicy3442DFF1", "Roles": [ { "Ref": "McpsProxyTaskDefExecutionRole25847ADA" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Proxy/TaskDef/ExecutionRole/DefaultPolicy/Resource" } }, "McpsProxyLogsE57B5A43": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": "/bb-appliance/proxy", "RetentionInDays": 30, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Proxy/Logs/Resource" } }, "McpsProxyService115EE3BC": { "Type": "AWS::ECS::Service", "Properties": { "Cluster": { "Ref": "ClusterEB0386A7" }, "DeploymentConfiguration": { "Alarms": { "AlarmNames": [], "Enable": false, "Rollback": false }, "DeploymentCircuitBreaker": { "Enable": true, "Rollback": true }, "MaximumPercent": 200, "MinimumHealthyPercent": 50 }, "DeploymentController": { "Type": "ECS" }, "DesiredCount": 1, "EnableECSManagedTags": false, "HealthCheckGracePeriodSeconds": 60, "LaunchType": "FARGATE", "LoadBalancers": [ { "ContainerName": "app", "ContainerPort": 8777, "TargetGroupArn": { "Ref": "McpsProxyTgF7EFDE6A" } } ], "NetworkConfiguration": { "AwsvpcConfiguration": { "AssignPublicIp": "DISABLED", "SecurityGroups": [ { "Fn::GetAtt": [ "McpsProxyServiceSecurityGroupCAF3D757", "GroupId" ] } ], "Subnets": [ { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" }, { "Ref": "NetworkVpcappSubnet2SubnetC46F4198" } ] } }, "ServiceName": "bb-appliance-proxy", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskDefinition": { "Ref": "McpsProxyTaskDef9DB70E9A" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "EdgeAlbHttpsproxyRuleRule7A63DFE1", "McpsProxyTaskDefTaskRole8BDDB3C6" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Proxy/Service/Service" } }, "McpsProxyServiceSecurityGroupCAF3D757": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "BrainbaseAppliance/Mcps/Proxy/Service/SecurityGroup", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "McpsProxyTaskDefTaskRole8BDDB3C6" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Proxy/Service/SecurityGroup/Resource" } }, "McpsProxyServiceSecurityGroupfromBrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE877717D60574": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "Description": "Load balancer to target", "FromPort": 8777, "GroupId": { "Fn::GetAtt": [ "McpsProxyServiceSecurityGroupCAF3D757", "GroupId" ] }, "IpProtocol": "tcp", "SourceSecurityGroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "ToPort": 8777 }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "McpsProxyTaskDefTaskRole8BDDB3C6" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Proxy/Service/SecurityGroup/from BrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE:8777" } }, "McpsProxyServiceTaskCountTarget5482CE50": { "Type": "AWS::ApplicationAutoScaling::ScalableTarget", "Properties": { "MaxCapacity": 4, "MinCapacity": 1, "ResourceId": { "Fn::Join": [ "", [ "service/", { "Ref": "ClusterEB0386A7" }, "/", { "Fn::GetAtt": [ "McpsProxyService115EE3BC", "Name" ] } ] ] }, "RoleARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService" ] ] }, "ScalableDimension": "ecs:service:DesiredCount", "ServiceNamespace": "ecs" }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "McpsProxyTaskDefTaskRole8BDDB3C6" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Proxy/Service/TaskCount/Target/Resource" } }, "McpsProxyServiceTaskCountTargetCpu509F8814": { "Type": "AWS::ApplicationAutoScaling::ScalingPolicy", "Properties": { "PolicyName": "BrainbaseApplianceMcpsProxyServiceTaskCountTargetCpu0C35BBED", "PolicyType": "TargetTrackingScaling", "ScalingTargetId": { "Ref": "McpsProxyServiceTaskCountTarget5482CE50" }, "TargetTrackingScalingPolicyConfiguration": { "PredefinedMetricSpecification": { "PredefinedMetricType": "ECSServiceAverageCPUUtilization" }, "TargetValue": 60 } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "McpsProxyTaskDefTaskRole8BDDB3C6" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Proxy/Service/TaskCount/Target/Cpu/Resource" } }, "McpsProxyTgF7EFDE6A": { "Type": "AWS::ElasticLoadBalancingV2::TargetGroup", "Properties": { "HealthCheckPath": "/healthz", "Port": 8777, "Protocol": "HTTP", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TargetGroupAttributes": [ { "Key": "deregistration_delay.timeout_seconds", "Value": "15" }, { "Key": "stickiness.enabled", "Value": "false" } ], "TargetType": "ip", "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mcps/Proxy/Tg/Resource" } }, "MasWebTaskDefTaskRoleC609E309": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Web/TaskDef/TaskRole/Resource" } }, "MasWebTaskDefTaskRoleDefaultPolicyE7466C9A": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "lambda:RunMicroVm", "lambda:GetMicrovm", "lambda:ListMicrovms", "lambda:SuspendMicrovm", "lambda:ResumeMicrovm", "lambda:TerminateMicrovm", "lambda:CreateMicrovmAuthToken" ], "Effect": "Allow", "Resource": "*", "Sid": "MicrovmLifecycle" }, { "Action": "lambda:PassNetworkConnector", "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:aws:lambda:", { "Ref": "AWS::Region" }, ":aws:network-connector:aws-network-connector:ALL_INGRESS" ] ] }, { "Fn::Join": [ "", [ "arn:aws:lambda:", { "Ref": "AWS::Region" }, ":aws:network-connector:aws-network-connector:INTERNET_EGRESS" ] ] } ], "Sid": "MicrovmPassNetworkConnector" }, { "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "MicrovmResourcesBucketA569B5D3", "Arn" ] }, "/microvm-workspaces/*" ] ] }, "Sid": "MicrovmWorkspaceObjects" }, { "Action": "s3:ListBucket", "Condition": { "StringLike": { "s3:prefix": [ "microvm-workspaces/*" ] } }, "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "MicrovmResourcesBucketA569B5D3", "Arn" ] }, "Sid": "MicrovmWorkspaceListBucket" }, { "Action": "aws-marketplace:MeterUsage", "Effect": "Allow", "Resource": "*", "Sid": "MarketplaceMetering" } ], "Version": "2012-10-17" }, "PolicyName": "MasWebTaskDefTaskRoleDefaultPolicyE7466C9A", "Roles": [ { "Ref": "MasWebTaskDefTaskRoleC609E309" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Web/TaskDef/TaskRole/DefaultPolicy/Resource" } }, "MasWebTaskDefD00489AF": { "Type": "AWS::ECS::TaskDefinition", "Properties": { "ContainerDefinitions": [ { "Command": [ "uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "1" ], "Environment": [ { "Name": "SUPABASE_URL", "Value": { "Fn::Join": [ "", [ "https://supabase.", { "Ref": "DomainName" } ] ] } }, { "Name": "KAFKA_LLM_PROXY_BASE_URL", "Value": { "Fn::Join": [ "", [ "https://llm.", { "Ref": "DomainName" } ] ] } }, { "Name": "SERVICE_SELF_BASE_URL", "Value": { "Fn::Join": [ "", [ "https://api.", { "Ref": "DomainName" } ] ] } }, { "Name": "MCP_PUBLIC_BASE_URL", "Value": { "Fn::Join": [ "", [ "https://api.", { "Ref": "DomainName" } ] ] } }, { "Name": "BRAINBASE_EVENT_ROUTER_ENDPOINT", "Value": { "Fn::Join": [ "", [ "https://api.", { "Ref": "DomainName" }, "/v2/internal/events" ] ] } }, { "Name": "BRAINBASE_GITHUB_MCP_URL", "Value": { "Fn::Join": [ "", [ "https://github.", { "Ref": "DomainName" } ] ] } }, { "Name": "BRAINBASE_ORCHESTRATION_MCP_URL", "Value": { "Fn::Join": [ "", [ "https://orchestration.", { "Ref": "DomainName" } ] ] } }, { "Name": "BRAINBASE_SLACK_MCP_URL", "Value": { "Fn::Join": [ "", [ "https://slack.", { "Ref": "DomainName" } ] ] } }, { "Name": "BRAINBASE_MCP_PROXY_URL", "Value": { "Fn::Join": [ "", [ "https://proxy.", { "Ref": "DomainName" } ] ] } }, { "Name": "BRAINBASE_LINEAR_MCP_URL", "Value": { "Fn::Join": [ "", [ "https://linear.", { "Ref": "DomainName" } ] ] } }, { "Name": "LINEAR_MCP_INJECTION_ENABLED", "Value": "false" }, { "Name": "BRAINBASE_CONTROL_PLANE_BASE_URL", "Value": { "Fn::Join": [ "", [ "https://api.", { "Ref": "DomainName" } ] ] } }, { "Name": "AWS_MICROVM_ENABLED", "Value": "true" }, { "Name": "AWS_MICROVM_ACP_IMAGE_ARN", "Value": { "Fn::Join": [ "", [ "arn:aws:lambda:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":microvm-image:brainbase-acp-unified-microvm" ] ] } }, { "Name": "AWS_MICROVM_REGION", "Value": { "Ref": "AWS::Region" } }, { "Name": "AWS_MICROVM_EXPORT_BUCKET", "Value": { "Ref": "MicrovmResourcesBucketA569B5D3" } }, { "Name": "DEFAULT_MACHINE_KIND", "Value": "aws_microvm" }, { "Name": "OPENCODE_NATIVE_LLM_SURFACES", "Value": "true" }, { "Name": "SWEEP_MODE", "Value": "active" }, { "Name": "BILLING_MODE", "Value": "marketplace" }, { "Name": "MARKETPLACE_PRODUCT_CODE", "Value": "6mq6xj2rkcoaj64hhp4v6vosy" }, { "Name": "MARKETPLACE_PRODUCT_ID", "Value": "prod-tybfxfqqhxbi6" }, { "Name": "MARKETPLACE_REPORTER_MAX_AGE_S", "Value": "3600" } ], "Essential": true, "Image": "709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-mas:sha-57803f6eb9d2-7147888b", "LogConfiguration": { "LogDriver": "awslogs", "Options": { "awslogs-group": { "Ref": "MasWebLogs35FC160F" }, "awslogs-stream-prefix": "mas-web", "awslogs-region": { "Ref": "AWS::Region" } } }, "Name": "app", "PortMappings": [ { "ContainerPort": 8000, "Protocol": "tcp" } ], "Secrets": [ { "Name": "SUPABASE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SERVICE_ROLE_KEY::" ] ] } }, { "Name": "SUPABASE_JWT_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":JWT_SECRET::" ] ] } }, { "Name": "EVENTS_DUMP_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":EVENTS_DUMP_SECRET::" ] ] } }, { "Name": "ORCH_TRIGGER_FIRES_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":ORCH_TRIGGER_FIRES_SECRET::" ] ] } }, { "Name": "SWEEP_JUDGE_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":SWEEP_JUDGE_SECRET::" ] ] } }, { "Name": "PREVIEW_RESOLVE_SHARED_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":PREVIEW_RESOLVE_SHARED_SECRET::" ] ] } }, { "Name": "MCP_AUTH_SHARED_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":MCP_AUTH_SHARED_SECRET::" ] ] } }, { "Name": "LLM_SERVICE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":LLM_SERVICE_KEY::" ] ] } }, { "Name": "BRAINBASE_DATA_KEY_V1", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":BRAINBASE_DATA_KEY_V1::" ] ] } } ] } ], "Cpu": "1024", "ExecutionRoleArn": { "Fn::GetAtt": [ "MasWebTaskDefExecutionRole1A80091A", "Arn" ] }, "Family": "bb-appliance-mas-web", "Memory": "4096", "NetworkMode": "awsvpc", "RequiresCompatibilities": [ "FARGATE" ], "RuntimePlatform": { "CpuArchitecture": "ARM64" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskRoleArn": { "Fn::GetAtt": [ "MasWebTaskDefTaskRoleC609E309", "Arn" ] } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Web/TaskDef/Resource" } }, "MasWebTaskDefExecutionRole1A80091A": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Web/TaskDef/ExecutionRole/Resource" } }, "MasWebTaskDefExecutionRoleDefaultPolicy7AA30F42": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "MasWebLogs35FC160F", "Arn" ] } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "AppSecretsSecretBC39ACDC" } } ], "Version": "2012-10-17" }, "PolicyName": "MasWebTaskDefExecutionRoleDefaultPolicy7AA30F42", "Roles": [ { "Ref": "MasWebTaskDefExecutionRole1A80091A" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Web/TaskDef/ExecutionRole/DefaultPolicy/Resource" } }, "MasWebLogs35FC160F": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": "/bb-appliance/mas-web", "RetentionInDays": 30, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Web/Logs/Resource" } }, "MasWebServiceFE0FC7A2": { "Type": "AWS::ECS::Service", "Properties": { "Cluster": { "Ref": "ClusterEB0386A7" }, "DeploymentConfiguration": { "Alarms": { "AlarmNames": [], "Enable": false, "Rollback": false }, "DeploymentCircuitBreaker": { "Enable": true, "Rollback": true }, "MaximumPercent": 100, "MinimumHealthyPercent": 0 }, "DeploymentController": { "Type": "ECS" }, "DesiredCount": 1, "EnableECSManagedTags": false, "HealthCheckGracePeriodSeconds": 60, "LaunchType": "FARGATE", "LoadBalancers": [ { "ContainerName": "app", "ContainerPort": 8000, "TargetGroupArn": { "Ref": "MasWebTgDEF6F588" } } ], "NetworkConfiguration": { "AwsvpcConfiguration": { "AssignPublicIp": "DISABLED", "SecurityGroups": [ { "Fn::GetAtt": [ "MasWebServiceSecurityGroupC910FFF6", "GroupId" ] } ], "Subnets": [ { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" }, { "Ref": "NetworkVpcappSubnet2SubnetC46F4198" } ] } }, "ServiceName": "bb-appliance-mas-web", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskDefinition": { "Ref": "MasWebTaskDefD00489AF" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "EdgeAlbHttpsmaswebRuleRule2EF71D65", "MasWebTaskDefTaskRoleDefaultPolicyE7466C9A", "MasWebTaskDefTaskRoleC609E309" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Web/Service/Service" } }, "MasWebServiceSecurityGroupC910FFF6": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "BrainbaseAppliance/Mas/Web/Service/SecurityGroup", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "MasWebTaskDefTaskRoleDefaultPolicyE7466C9A", "MasWebTaskDefTaskRoleC609E309" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Web/Service/SecurityGroup/Resource" } }, "MasWebServiceSecurityGroupfromBrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE8000845AF014": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "Description": "Load balancer to target", "FromPort": 8000, "GroupId": { "Fn::GetAtt": [ "MasWebServiceSecurityGroupC910FFF6", "GroupId" ] }, "IpProtocol": "tcp", "SourceSecurityGroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "ToPort": 8000 }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "MasWebTaskDefTaskRoleDefaultPolicyE7466C9A", "MasWebTaskDefTaskRoleC609E309" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Web/Service/SecurityGroup/from BrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE:8000" } }, "MasWebTgDEF6F588": { "Type": "AWS::ElasticLoadBalancingV2::TargetGroup", "Properties": { "HealthCheckPath": "/healthz", "Port": 8000, "Protocol": "HTTP", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TargetGroupAttributes": [ { "Key": "deregistration_delay.timeout_seconds", "Value": "15" }, { "Key": "stickiness.enabled", "Value": "false" } ], "TargetType": "ip", "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Web/Tg/Resource" } }, "MasBillingTaskDefTaskRole26138C0A": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Billing/TaskDef/TaskRole/Resource" } }, "MasBillingTaskDefTaskRoleDefaultPolicy3F12205A": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "aws-marketplace:MeterUsage", "Effect": "Allow", "Resource": "*", "Sid": "MarketplaceMetering" }, { "Action": "aws-marketplace:SearchAgreements", "Effect": "Allow", "Resource": "*", "Sid": "MarketplaceAgreements" } ], "Version": "2012-10-17" }, "PolicyName": "MasBillingTaskDefTaskRoleDefaultPolicy3F12205A", "Roles": [ { "Ref": "MasBillingTaskDefTaskRole26138C0A" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Billing/TaskDef/TaskRole/DefaultPolicy/Resource" } }, "MasBillingTaskDefEE6E860E": { "Type": "AWS::ECS::TaskDefinition", "Properties": { "ContainerDefinitions": [ { "Command": [ "sh", "-c", "start=$(date +%s); while true; do python -m src.billing.reconcile || true; if [ $(( $(date +%s) - start )) -ge \"${MARKETPLACE_REPORTER_MAX_AGE_S:-3600}\" ]; then exit 0; fi; sleep 60; done" ], "Environment": [ { "Name": "SUPABASE_URL", "Value": { "Fn::Join": [ "", [ "https://supabase.", { "Ref": "DomainName" } ] ] } }, { "Name": "KAFKA_LLM_PROXY_BASE_URL", "Value": { "Fn::Join": [ "", [ "https://llm.", { "Ref": "DomainName" } ] ] } }, { "Name": "SERVICE_SELF_BASE_URL", "Value": { "Fn::Join": [ "", [ "https://api.", { "Ref": "DomainName" } ] ] } }, { "Name": "MCP_PUBLIC_BASE_URL", "Value": { "Fn::Join": [ "", [ "https://api.", { "Ref": "DomainName" } ] ] } }, { "Name": "BRAINBASE_EVENT_ROUTER_ENDPOINT", "Value": { "Fn::Join": [ "", [ "https://api.", { "Ref": "DomainName" }, "/v2/internal/events" ] ] } }, { "Name": "BRAINBASE_GITHUB_MCP_URL", "Value": { "Fn::Join": [ "", [ "https://github.", { "Ref": "DomainName" } ] ] } }, { "Name": "BRAINBASE_ORCHESTRATION_MCP_URL", "Value": { "Fn::Join": [ "", [ "https://orchestration.", { "Ref": "DomainName" } ] ] } }, { "Name": "BRAINBASE_SLACK_MCP_URL", "Value": { "Fn::Join": [ "", [ "https://slack.", { "Ref": "DomainName" } ] ] } }, { "Name": "BRAINBASE_MCP_PROXY_URL", "Value": { "Fn::Join": [ "", [ "https://proxy.", { "Ref": "DomainName" } ] ] } }, { "Name": "BRAINBASE_LINEAR_MCP_URL", "Value": { "Fn::Join": [ "", [ "https://linear.", { "Ref": "DomainName" } ] ] } }, { "Name": "LINEAR_MCP_INJECTION_ENABLED", "Value": "false" }, { "Name": "BRAINBASE_CONTROL_PLANE_BASE_URL", "Value": { "Fn::Join": [ "", [ "https://api.", { "Ref": "DomainName" } ] ] } }, { "Name": "AWS_MICROVM_ENABLED", "Value": "true" }, { "Name": "AWS_MICROVM_ACP_IMAGE_ARN", "Value": { "Fn::Join": [ "", [ "arn:aws:lambda:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":microvm-image:brainbase-acp-unified-microvm" ] ] } }, { "Name": "AWS_MICROVM_REGION", "Value": { "Ref": "AWS::Region" } }, { "Name": "AWS_MICROVM_EXPORT_BUCKET", "Value": { "Ref": "MicrovmResourcesBucketA569B5D3" } }, { "Name": "DEFAULT_MACHINE_KIND", "Value": "aws_microvm" }, { "Name": "OPENCODE_NATIVE_LLM_SURFACES", "Value": "true" }, { "Name": "SWEEP_MODE", "Value": "active" }, { "Name": "BILLING_MODE", "Value": "marketplace" }, { "Name": "MARKETPLACE_PRODUCT_CODE", "Value": "6mq6xj2rkcoaj64hhp4v6vosy" }, { "Name": "MARKETPLACE_PRODUCT_ID", "Value": "prod-tybfxfqqhxbi6" }, { "Name": "MARKETPLACE_REPORTER_MAX_AGE_S", "Value": "3600" } ], "Essential": true, "Image": "709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-mas:sha-57803f6eb9d2-7147888b", "LogConfiguration": { "LogDriver": "awslogs", "Options": { "awslogs-group": { "Ref": "MasBillingLogsDF510F12" }, "awslogs-stream-prefix": "mas-billing", "awslogs-region": { "Ref": "AWS::Region" } } }, "Name": "app", "Secrets": [ { "Name": "SUPABASE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SERVICE_ROLE_KEY::" ] ] } }, { "Name": "SUPABASE_JWT_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":JWT_SECRET::" ] ] } }, { "Name": "EVENTS_DUMP_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":EVENTS_DUMP_SECRET::" ] ] } }, { "Name": "ORCH_TRIGGER_FIRES_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":ORCH_TRIGGER_FIRES_SECRET::" ] ] } }, { "Name": "SWEEP_JUDGE_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":SWEEP_JUDGE_SECRET::" ] ] } }, { "Name": "PREVIEW_RESOLVE_SHARED_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":PREVIEW_RESOLVE_SHARED_SECRET::" ] ] } }, { "Name": "MCP_AUTH_SHARED_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":MCP_AUTH_SHARED_SECRET::" ] ] } }, { "Name": "LLM_SERVICE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":LLM_SERVICE_KEY::" ] ] } }, { "Name": "BRAINBASE_DATA_KEY_V1", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":BRAINBASE_DATA_KEY_V1::" ] ] } } ] } ], "Cpu": "256", "ExecutionRoleArn": { "Fn::GetAtt": [ "MasBillingTaskDefExecutionRole74AA7EA1", "Arn" ] }, "Family": "bb-appliance-mas-billing", "Memory": "1024", "NetworkMode": "awsvpc", "RequiresCompatibilities": [ "FARGATE" ], "RuntimePlatform": { "CpuArchitecture": "ARM64" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskRoleArn": { "Fn::GetAtt": [ "MasBillingTaskDefTaskRole26138C0A", "Arn" ] } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Billing/TaskDef/Resource" } }, "MasBillingTaskDefExecutionRole74AA7EA1": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Billing/TaskDef/ExecutionRole/Resource" } }, "MasBillingTaskDefExecutionRoleDefaultPolicy0F4A41BB": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "MasBillingLogsDF510F12", "Arn" ] } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "AppSecretsSecretBC39ACDC" } } ], "Version": "2012-10-17" }, "PolicyName": "MasBillingTaskDefExecutionRoleDefaultPolicy0F4A41BB", "Roles": [ { "Ref": "MasBillingTaskDefExecutionRole74AA7EA1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Billing/TaskDef/ExecutionRole/DefaultPolicy/Resource" } }, "MasBillingLogsDF510F12": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": "/bb-appliance/mas-billing", "RetentionInDays": 30, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Billing/Logs/Resource" } }, "MasBillingService9195AD83": { "Type": "AWS::ECS::Service", "Properties": { "Cluster": { "Ref": "ClusterEB0386A7" }, "DeploymentConfiguration": { "Alarms": { "AlarmNames": [], "Enable": false, "Rollback": false }, "DeploymentCircuitBreaker": { "Enable": false, "Rollback": false }, "MaximumPercent": 100, "MinimumHealthyPercent": 0 }, "DeploymentController": { "Type": "ECS" }, "DesiredCount": 1, "EnableECSManagedTags": false, "LaunchType": "FARGATE", "NetworkConfiguration": { "AwsvpcConfiguration": { "AssignPublicIp": "DISABLED", "SecurityGroups": [ { "Fn::GetAtt": [ "MasBillingServiceSecurityGroup3F6C2DF0", "GroupId" ] } ], "Subnets": [ { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" }, { "Ref": "NetworkVpcappSubnet2SubnetC46F4198" } ] } }, "ServiceName": "bb-appliance-mas-billing", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskDefinition": { "Ref": "MasBillingTaskDefEE6E860E" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "MasBillingTaskDefTaskRoleDefaultPolicy3F12205A", "MasBillingTaskDefTaskRole26138C0A" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Billing/Service/Service" } }, "MasBillingServiceSecurityGroup3F6C2DF0": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "BrainbaseAppliance/Mas/Billing/Service/SecurityGroup", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "MasBillingTaskDefTaskRoleDefaultPolicy3F12205A", "MasBillingTaskDefTaskRole26138C0A" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Billing/Service/SecurityGroup/Resource" } }, "MasSchedulerTaskDefTaskRoleB65B4F4F": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Scheduler/TaskDef/TaskRole/Resource" } }, "MasSchedulerTaskDefTaskRoleDefaultPolicy3241C90D": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "lambda:RunMicroVm", "lambda:GetMicrovm", "lambda:ListMicrovms", "lambda:SuspendMicrovm", "lambda:ResumeMicrovm", "lambda:TerminateMicrovm", "lambda:CreateMicrovmAuthToken" ], "Effect": "Allow", "Resource": "*", "Sid": "MicrovmLifecycle" }, { "Action": "lambda:PassNetworkConnector", "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:aws:lambda:", { "Ref": "AWS::Region" }, ":aws:network-connector:aws-network-connector:ALL_INGRESS" ] ] }, { "Fn::Join": [ "", [ "arn:aws:lambda:", { "Ref": "AWS::Region" }, ":aws:network-connector:aws-network-connector:INTERNET_EGRESS" ] ] } ], "Sid": "MicrovmPassNetworkConnector" }, { "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "MicrovmResourcesBucketA569B5D3", "Arn" ] }, "/microvm-workspaces/*" ] ] }, "Sid": "MicrovmWorkspaceObjects" }, { "Action": "s3:ListBucket", "Condition": { "StringLike": { "s3:prefix": [ "microvm-workspaces/*" ] } }, "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "MicrovmResourcesBucketA569B5D3", "Arn" ] }, "Sid": "MicrovmWorkspaceListBucket" } ], "Version": "2012-10-17" }, "PolicyName": "MasSchedulerTaskDefTaskRoleDefaultPolicy3241C90D", "Roles": [ { "Ref": "MasSchedulerTaskDefTaskRoleB65B4F4F" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Scheduler/TaskDef/TaskRole/DefaultPolicy/Resource" } }, "MasSchedulerTaskDefB9FA3127": { "Type": "AWS::ECS::TaskDefinition", "Properties": { "ContainerDefinitions": [ { "Command": [ "sh", "-c", "while true; do python -m src.scheduler.tick || true; sleep 60; done" ], "Environment": [ { "Name": "SUPABASE_URL", "Value": { "Fn::Join": [ "", [ "https://supabase.", { "Ref": "DomainName" } ] ] } }, { "Name": "KAFKA_LLM_PROXY_BASE_URL", "Value": { "Fn::Join": [ "", [ "https://llm.", { "Ref": "DomainName" } ] ] } }, { "Name": "SERVICE_SELF_BASE_URL", "Value": { "Fn::Join": [ "", [ "https://api.", { "Ref": "DomainName" } ] ] } }, { "Name": "MCP_PUBLIC_BASE_URL", "Value": { "Fn::Join": [ "", [ "https://api.", { "Ref": "DomainName" } ] ] } }, { "Name": "BRAINBASE_EVENT_ROUTER_ENDPOINT", "Value": { "Fn::Join": [ "", [ "https://api.", { "Ref": "DomainName" }, "/v2/internal/events" ] ] } }, { "Name": "BRAINBASE_GITHUB_MCP_URL", "Value": { "Fn::Join": [ "", [ "https://github.", { "Ref": "DomainName" } ] ] } }, { "Name": "BRAINBASE_ORCHESTRATION_MCP_URL", "Value": { "Fn::Join": [ "", [ "https://orchestration.", { "Ref": "DomainName" } ] ] } }, { "Name": "BRAINBASE_SLACK_MCP_URL", "Value": { "Fn::Join": [ "", [ "https://slack.", { "Ref": "DomainName" } ] ] } }, { "Name": "BRAINBASE_MCP_PROXY_URL", "Value": { "Fn::Join": [ "", [ "https://proxy.", { "Ref": "DomainName" } ] ] } }, { "Name": "BRAINBASE_LINEAR_MCP_URL", "Value": { "Fn::Join": [ "", [ "https://linear.", { "Ref": "DomainName" } ] ] } }, { "Name": "LINEAR_MCP_INJECTION_ENABLED", "Value": "false" }, { "Name": "BRAINBASE_CONTROL_PLANE_BASE_URL", "Value": { "Fn::Join": [ "", [ "https://api.", { "Ref": "DomainName" } ] ] } }, { "Name": "AWS_MICROVM_ENABLED", "Value": "true" }, { "Name": "AWS_MICROVM_ACP_IMAGE_ARN", "Value": { "Fn::Join": [ "", [ "arn:aws:lambda:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":microvm-image:brainbase-acp-unified-microvm" ] ] } }, { "Name": "AWS_MICROVM_REGION", "Value": { "Ref": "AWS::Region" } }, { "Name": "AWS_MICROVM_EXPORT_BUCKET", "Value": { "Ref": "MicrovmResourcesBucketA569B5D3" } }, { "Name": "DEFAULT_MACHINE_KIND", "Value": "aws_microvm" }, { "Name": "OPENCODE_NATIVE_LLM_SURFACES", "Value": "true" }, { "Name": "SWEEP_MODE", "Value": "active" }, { "Name": "BILLING_MODE", "Value": "marketplace" }, { "Name": "MARKETPLACE_PRODUCT_CODE", "Value": "6mq6xj2rkcoaj64hhp4v6vosy" }, { "Name": "MARKETPLACE_PRODUCT_ID", "Value": "prod-tybfxfqqhxbi6" }, { "Name": "MARKETPLACE_REPORTER_MAX_AGE_S", "Value": "3600" } ], "Essential": true, "Image": "709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-mas:sha-57803f6eb9d2-7147888b", "LogConfiguration": { "LogDriver": "awslogs", "Options": { "awslogs-group": { "Ref": "MasSchedulerLogsF2F121BB" }, "awslogs-stream-prefix": "mas-scheduler", "awslogs-region": { "Ref": "AWS::Region" } } }, "Name": "app", "Secrets": [ { "Name": "SUPABASE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SERVICE_ROLE_KEY::" ] ] } }, { "Name": "SUPABASE_JWT_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":JWT_SECRET::" ] ] } }, { "Name": "EVENTS_DUMP_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":EVENTS_DUMP_SECRET::" ] ] } }, { "Name": "ORCH_TRIGGER_FIRES_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":ORCH_TRIGGER_FIRES_SECRET::" ] ] } }, { "Name": "SWEEP_JUDGE_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":SWEEP_JUDGE_SECRET::" ] ] } }, { "Name": "PREVIEW_RESOLVE_SHARED_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":PREVIEW_RESOLVE_SHARED_SECRET::" ] ] } }, { "Name": "MCP_AUTH_SHARED_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":MCP_AUTH_SHARED_SECRET::" ] ] } }, { "Name": "LLM_SERVICE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":LLM_SERVICE_KEY::" ] ] } }, { "Name": "BRAINBASE_DATA_KEY_V1", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":BRAINBASE_DATA_KEY_V1::" ] ] } } ] } ], "Cpu": "256", "ExecutionRoleArn": { "Fn::GetAtt": [ "MasSchedulerTaskDefExecutionRoleE9959D8D", "Arn" ] }, "Family": "bb-appliance-mas-scheduler", "Memory": "1024", "NetworkMode": "awsvpc", "RequiresCompatibilities": [ "FARGATE" ], "RuntimePlatform": { "CpuArchitecture": "ARM64" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskRoleArn": { "Fn::GetAtt": [ "MasSchedulerTaskDefTaskRoleB65B4F4F", "Arn" ] } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Scheduler/TaskDef/Resource" } }, "MasSchedulerTaskDefExecutionRoleE9959D8D": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Scheduler/TaskDef/ExecutionRole/Resource" } }, "MasSchedulerTaskDefExecutionRoleDefaultPolicyB1707D7C": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "MasSchedulerLogsF2F121BB", "Arn" ] } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "AppSecretsSecretBC39ACDC" } } ], "Version": "2012-10-17" }, "PolicyName": "MasSchedulerTaskDefExecutionRoleDefaultPolicyB1707D7C", "Roles": [ { "Ref": "MasSchedulerTaskDefExecutionRoleE9959D8D" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Scheduler/TaskDef/ExecutionRole/DefaultPolicy/Resource" } }, "MasSchedulerLogsF2F121BB": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": "/bb-appliance/mas-scheduler", "RetentionInDays": 30, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Scheduler/Logs/Resource" } }, "MasSchedulerServiceA4872856": { "Type": "AWS::ECS::Service", "Properties": { "Cluster": { "Ref": "ClusterEB0386A7" }, "DeploymentConfiguration": { "Alarms": { "AlarmNames": [], "Enable": false, "Rollback": false }, "DeploymentCircuitBreaker": { "Enable": false, "Rollback": false }, "MaximumPercent": 100, "MinimumHealthyPercent": 0 }, "DeploymentController": { "Type": "ECS" }, "DesiredCount": 1, "EnableECSManagedTags": false, "LaunchType": "FARGATE", "NetworkConfiguration": { "AwsvpcConfiguration": { "AssignPublicIp": "DISABLED", "SecurityGroups": [ { "Fn::GetAtt": [ "MasSchedulerServiceSecurityGroupF4CA1F47", "GroupId" ] } ], "Subnets": [ { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" }, { "Ref": "NetworkVpcappSubnet2SubnetC46F4198" } ] } }, "ServiceName": "bb-appliance-mas-scheduler", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskDefinition": { "Ref": "MasSchedulerTaskDefB9FA3127" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "MasSchedulerTaskDefTaskRoleDefaultPolicy3241C90D", "MasSchedulerTaskDefTaskRoleB65B4F4F" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Scheduler/Service/Service" } }, "MasSchedulerServiceSecurityGroupF4CA1F47": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "BrainbaseAppliance/Mas/Scheduler/Service/SecurityGroup", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "MasSchedulerTaskDefTaskRoleDefaultPolicy3241C90D", "MasSchedulerTaskDefTaskRoleB65B4F4F" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Mas/Scheduler/Service/SecurityGroup/Resource" } }, "ObsAlertTopicC6E3505C": { "Type": "AWS::SNS::Topic", "Properties": { "DisplayName": "bb-appliance alerts", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TopicName": "bb-appliance-alerts" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Obs/AlertTopic/Resource" } }, "ObsAlertTopicTokenSubscription1A97B207F": { "Type": "AWS::SNS::Subscription", "Properties": { "Endpoint": { "Ref": "AlarmEmail" }, "Protocol": "email", "TopicArn": { "Ref": "ObsAlertTopicC6E3505C" } }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Obs/AlertTopic/TokenSubscription:1/Resource" } }, "ObsAlb5xx7FD54B19": { "Type": "AWS::CloudWatch::Alarm", "Properties": { "AlarmActions": [ { "Ref": "ObsAlertTopicC6E3505C" } ], "AlarmDescription": "Target 5xx responses through the appliance ALB exceeded threshold.", "AlarmName": "bb-appliance-alb-5xx", "ComparisonOperator": "GreaterThanOrEqualToThreshold", "Dimensions": [ { "Name": "LoadBalancer", "Value": { "Fn::GetAtt": [ "EdgeAlb09518372", "LoadBalancerFullName" ] } } ], "EvaluationPeriods": 2, "MetricName": "HTTPCode_Target_5XX_Count", "Namespace": "AWS/ApplicationELB", "OKActions": [ { "Ref": "ObsAlertTopicC6E3505C" } ], "Period": 300, "Statistic": "Sum", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Threshold": 10, "TreatMissingData": "notBreaching" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Obs/Alb5xx/Resource" } }, "ObsPgdumpStale8EA85E3A": { "Type": "AWS::CloudWatch::Alarm", "Properties": { "AlarmActions": [ { "Ref": "ObsAlertTopicC6E3505C" } ], "AlarmDescription": "No successful nightly Postgres logical backup for 2 consecutive days (bb-appliance/PgdumpSuccess).", "AlarmName": "bb-appliance-pgdump-stale", "ComparisonOperator": "LessThanThreshold", "DatapointsToAlarm": 2, "EvaluationPeriods": 2, "MetricName": "PgdumpSuccess", "Namespace": "bb-appliance", "OKActions": [ { "Ref": "ObsAlertTopicC6E3505C" } ], "Period": 86400, "Statistic": "Sum", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Threshold": 1, "TreatMissingData": "breaching" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Obs/PgdumpStale/Resource" } }, "ObsMarketplaceMeteringHeartbeatDF74B072": { "Type": "AWS::Logs::MetricFilter", "Properties": { "FilterPattern": "\"marketplace metering pass:\"", "LogGroupName": { "Ref": "MasBillingLogsDF510F12" }, "MetricTransformations": [ { "DefaultValue": 0, "MetricName": "MarketplaceMeteringPass", "MetricNamespace": "bb-appliance", "MetricValue": "1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Obs/MarketplaceMeteringHeartbeat/Resource" } }, "ObsMarketplaceMeteringQuietSignal6960ECCF": { "Type": "AWS::CloudWatch::Alarm", "Properties": { "AlarmDescription": "Marketplace metering heartbeat is absent for 15 minutes.", "AlarmName": "bb-appliance-marketplace-metering-quiet-signal", "ComparisonOperator": "LessThanThreshold", "DatapointsToAlarm": 3, "EvaluationPeriods": 3, "MetricName": "MarketplaceMeteringPass", "Namespace": "bb-appliance", "Period": 300, "Statistic": "Sum", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Threshold": 1, "TreatMissingData": "breaching" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Obs/MarketplaceMeteringQuietSignal/Resource" } }, "ObsMarketplaceMeteringAlarmClockRoleB2FC70F2": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "scheduler.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": "cloudwatch:PutMetricData", "Condition": { "StringEquals": { "cloudwatch:namespace": "bb-appliance" } }, "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "PutMetricData" } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Obs/MarketplaceMeteringAlarmClockRole/Resource" } }, "ObsMarketplaceMeteringAlarmClock2C278D13": { "Type": "AWS::Scheduler::Schedule", "Properties": { "Description": "Arms the Marketplace metering silence alarm after deployment grace.", "FlexibleTimeWindow": { "Mode": "OFF" }, "ScheduleExpression": "rate(1 minute)", "Target": { "Arn": "arn:aws:scheduler:::aws-sdk:cloudwatch:putMetricData", "Input": { "Fn::Join": [ "", [ "{\"Namespace\":\"bb-appliance\",\"MetricData\":[{\"MetricName\":\"MarketplaceMeteringAlarmClock\",\"Dimensions\":[{\"Name\":\"StackId\",\"Value\":\"", { "Ref": "AWS::StackId" }, "\"}],\"Unit\":\"Count\",\"Value\":1}]}" ] ] }, "RoleArn": { "Fn::GetAtt": [ "ObsMarketplaceMeteringAlarmClockRoleB2FC70F2", "Arn" ] } } }, "DependsOn": [ "MasBillingServiceSecurityGroup3F6C2DF0", "MasBillingService9195AD83" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Obs/MarketplaceMeteringAlarmClock" } }, "ObsMarketplaceMeteringGraceElapsedA5CCA3B0": { "Type": "AWS::CloudWatch::Alarm", "Properties": { "AlarmDescription": "The post-deployment grace period for Marketplace metering has elapsed.", "AlarmName": "bb-appliance-marketplace-metering-grace-elapsed", "ComparisonOperator": "GreaterThanOrEqualToThreshold", "DatapointsToAlarm": 4, "Dimensions": [ { "Name": "StackId", "Value": { "Ref": "AWS::StackId" } } ], "EvaluationPeriods": 4, "MetricName": "MarketplaceMeteringAlarmClock", "Namespace": "bb-appliance", "Period": 300, "Statistic": "Sum", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Threshold": 1, "TreatMissingData": "ignore" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Obs/MarketplaceMeteringGraceElapsed/Resource" } }, "ObsMarketplaceMeteringFailing84FE979D": { "Type": "AWS::CloudWatch::Alarm", "Properties": { "AlarmDescription": "MAS billing logs are active without a successful Marketplace metering pass.", "AlarmName": "bb-appliance-marketplace-metering-failing-signal", "ComparisonOperator": "LessThanThreshold", "DatapointsToAlarm": 3, "EvaluationPeriods": 3, "MetricName": "MarketplaceMeteringPass", "Namespace": "bb-appliance", "Period": 300, "Statistic": "Sum", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "Threshold": 1, "TreatMissingData": "notBreaching" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Obs/MarketplaceMeteringFailing/Resource" } }, "ObsMarketplaceMeteringQuietC7583584": { "Type": "AWS::CloudWatch::CompositeAlarm", "Properties": { "AlarmActions": [ { "Ref": "ObsAlertTopicC6E3505C" } ], "AlarmDescription": "No successful AWS Marketplace metering reconciliation for 15 minutes.", "AlarmName": "bb-appliance-marketplace-metering-quiet", "AlarmRule": { "Fn::Join": [ "", [ "(ALARM(\"", { "Fn::GetAtt": [ "ObsMarketplaceMeteringFailing84FE979D", "Arn" ] }, "\") OR (ALARM(\"", { "Fn::GetAtt": [ "ObsMarketplaceMeteringQuietSignal6960ECCF", "Arn" ] }, "\") AND ALARM(\"", { "Fn::GetAtt": [ "ObsMarketplaceMeteringGraceElapsedA5CCA3B0", "Arn" ] }, "\")))" ] ] }, "OKActions": [ { "Ref": "ObsAlertTopicC6E3505C" } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Obs/MarketplaceMeteringQuiet/Resource" } }, "ObsDashboardD217891F": { "Type": "AWS::CloudWatch::Dashboard", "Properties": { "DashboardBody": { "Fn::Join": [ "", [ "{\"widgets\":[{\"type\":\"metric\",\"width\":6,\"height\":6,\"x\":0,\"y\":0,\"properties\":{\"view\":\"timeSeries\",\"title\":\"ALB requests\",\"region\":\"", { "Ref": "AWS::Region" }, "\",\"metrics\":[[\"AWS/ApplicationELB\",\"RequestCount\",\"LoadBalancer\",\"", { "Fn::GetAtt": [ "EdgeAlb09518372", "LoadBalancerFullName" ] }, "\",{\"stat\":\"Sum\"}]],\"yAxis\":{}}},{\"type\":\"metric\",\"width\":6,\"height\":6,\"x\":6,\"y\":0,\"properties\":{\"view\":\"timeSeries\",\"title\":\"Target 5xx\",\"region\":\"", { "Ref": "AWS::Region" }, "\",\"metrics\":[[\"AWS/ApplicationELB\",\"HTTPCode_Target_5XX_Count\",\"LoadBalancer\",\"", { "Fn::GetAtt": [ "EdgeAlb09518372", "LoadBalancerFullName" ] }, "\",{\"stat\":\"Sum\"}]],\"yAxis\":{}}},{\"type\":\"metric\",\"width\":6,\"height\":6,\"x\":12,\"y\":0,\"properties\":{\"view\":\"timeSeries\",\"title\":\"Nightly backup success\",\"region\":\"", { "Ref": "AWS::Region" }, "\",\"metrics\":[[\"bb-appliance\",\"PgdumpSuccess\",{\"period\":86400,\"stat\":\"Sum\"}]],\"yAxis\":{}}},{\"type\":\"metric\",\"width\":6,\"height\":6,\"x\":18,\"y\":0,\"properties\":{\"view\":\"timeSeries\",\"title\":\"Marketplace metering heartbeat\",\"region\":\"", { "Ref": "AWS::Region" }, "\",\"metrics\":[[\"bb-appliance\",\"MarketplaceMeteringPass\",{\"stat\":\"Sum\"}]],\"yAxis\":{}}}]}" ] ] }, "DashboardName": "bb-appliance", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Obs/Dashboard/Resource" } }, "ConnectorsServiceTaskDefTaskRole80C55FB4": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Connectors/Service/TaskDef/TaskRole/Resource" } }, "ConnectorsServiceTaskDef631A6BCD": { "Type": "AWS::ECS::TaskDefinition", "Properties": { "ContainerDefinitions": [ { "Environment": [ { "Name": "SUPABASE_URL", "Value": { "Fn::Join": [ "", [ "https://supabase.", { "Ref": "DomainName" } ] ] } }, { "Name": "AGENT_API_URL", "Value": "https://kafka-llm-service.onrender.com" }, { "Name": "BRAINBASE_API_URL", "Value": { "Fn::Join": [ "", [ "https://api.", { "Ref": "DomainName" } ] ] } }, { "Name": "PORT", "Value": "3000" }, { "Name": "SLACK_ENABLED", "Value": "true" }, { "Name": "SLACK_MACRO_UI", "Value": "message" }, { "Name": "SLACK_MACRO_ROUTING_ENABLED", "Value": "false" }, { "Name": "GITHUB_ENABLED", "Value": "false" }, { "Name": "MEETING_MCP_ENABLED", "Value": "false" }, { "Name": "TEAMS_ENABLED", "Value": "false" }, { "Name": "EMAIL_ENABLED", "Value": "false" }, { "Name": "LOG_LEVEL", "Value": "INFO" }, { "Name": "CONNECTOR_SHUTDOWN_TIMEOUT_SECONDS", "Value": "30" }, { "Name": "DEPLOYMENT_ENVIRONMENT", "Value": "bb-appliance" }, { "Name": "LINEAR_ENABLED", "Value": "false" }, { "Name": "LINEAR_PUBLIC_URL", "Value": { "Fn::Join": [ "", [ "https://hooks.", { "Ref": "DomainName" } ] ] } }, { "Name": "LINEAR_CLIENT_APP_URL", "Value": { "Fn::Join": [ "", [ "https://app.", { "Ref": "DomainName" } ] ] } } ], "Essential": true, "Image": "709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-connectors:sha-f07cf390dfa8", "LogConfiguration": { "LogDriver": "awslogs", "Options": { "awslogs-group": { "Ref": "ConnectorsServiceLogs6FA0E4E3" }, "awslogs-stream-prefix": "connectors", "awslogs-region": { "Ref": "AWS::Region" } } }, "Name": "app", "PortMappings": [ { "ContainerPort": 3000, "Protocol": "tcp" } ], "Secrets": [ { "Name": "SUPABASE_SERVICE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SERVICE_ROLE_KEY::" ] ] } }, { "Name": "SUPABASE_JWT_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":JWT_SECRET::" ] ] } }, { "Name": "BRAINBASE_GITHUB_DATA_KEY_V1", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":BRAINBASE_GITHUB_DATA_KEY_V1::" ] ] } }, { "Name": "LLM_SERVICE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":LLM_SERVICE_KEY::" ] ] } }, { "Name": "SLACK_SIGNING_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":SLACK_SIGNING_SECRET::" ] ] } }, { "Name": "SLACK_CLIENT_ID", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":SLACK_CLIENT_ID::" ] ] } }, { "Name": "SLACK_CLIENT_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":SLACK_CLIENT_SECRET::" ] ] } }, { "Name": "LINEAR_OAUTH_STATE_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":LINEAR_OAUTH_STATE_SECRET::" ] ] } }, { "Name": "BRAINBASE_LINEAR_DATA_KEY_V1", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":BRAINBASE_LINEAR_DATA_KEY_V1::" ] ] } } ], "StopTimeout": 30 } ], "Cpu": "512", "ExecutionRoleArn": { "Fn::GetAtt": [ "ConnectorsServiceTaskDefExecutionRole23E96932", "Arn" ] }, "Family": "bb-appliance-connectors", "Memory": "1024", "NetworkMode": "awsvpc", "RequiresCompatibilities": [ "FARGATE" ], "RuntimePlatform": { "CpuArchitecture": "ARM64" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskRoleArn": { "Fn::GetAtt": [ "ConnectorsServiceTaskDefTaskRole80C55FB4", "Arn" ] } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Connectors/Service/TaskDef/Resource" } }, "ConnectorsServiceTaskDefExecutionRole23E96932": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Connectors/Service/TaskDef/ExecutionRole/Resource" } }, "ConnectorsServiceTaskDefExecutionRoleDefaultPolicy4921D088": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "ConnectorsServiceLogs6FA0E4E3", "Arn" ] } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "AppSecretsSecretBC39ACDC" } } ], "Version": "2012-10-17" }, "PolicyName": "ConnectorsServiceTaskDefExecutionRoleDefaultPolicy4921D088", "Roles": [ { "Ref": "ConnectorsServiceTaskDefExecutionRole23E96932" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Connectors/Service/TaskDef/ExecutionRole/DefaultPolicy/Resource" } }, "ConnectorsServiceLogs6FA0E4E3": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": "/bb-appliance/connectors", "RetentionInDays": 30, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Connectors/Service/Logs/Resource" } }, "ConnectorsService856813DF": { "Type": "AWS::ECS::Service", "Properties": { "Cluster": { "Ref": "ClusterEB0386A7" }, "DeploymentConfiguration": { "Alarms": { "AlarmNames": [], "Enable": false, "Rollback": false }, "DeploymentCircuitBreaker": { "Enable": true, "Rollback": false }, "MaximumPercent": 200, "MinimumHealthyPercent": 50 }, "DeploymentController": { "Type": "ECS" }, "DesiredCount": 1, "EnableECSManagedTags": false, "HealthCheckGracePeriodSeconds": 60, "LaunchType": "FARGATE", "LoadBalancers": [ { "ContainerName": "app", "ContainerPort": 3000, "TargetGroupArn": { "Ref": "ConnectorsServiceTg227875E2" } } ], "NetworkConfiguration": { "AwsvpcConfiguration": { "AssignPublicIp": "DISABLED", "SecurityGroups": [ { "Fn::GetAtt": [ "ConnectorsServiceSecurityGroup83741966", "GroupId" ] } ], "Subnets": [ { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" }, { "Ref": "NetworkVpcappSubnet2SubnetC46F4198" } ] } }, "ServiceName": "bb-appliance-connectors", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskDefinition": { "Ref": "ConnectorsServiceTaskDef631A6BCD" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "ConnectorsServiceTaskDefTaskRole80C55FB4", "EdgeAlbHttpsconnectorsRuleRule920D4FF8" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Connectors/Service/Service/Service" } }, "ConnectorsServiceSecurityGroup83741966": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "BrainbaseAppliance/Connectors/Service/Service/SecurityGroup", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "ConnectorsServiceTaskDefTaskRole80C55FB4" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Connectors/Service/Service/SecurityGroup/Resource" } }, "ConnectorsServiceSecurityGroupfromBrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE3000A764A958": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "Description": "Load balancer to target", "FromPort": 3000, "GroupId": { "Fn::GetAtt": [ "ConnectorsServiceSecurityGroup83741966", "GroupId" ] }, "IpProtocol": "tcp", "SourceSecurityGroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "ToPort": 3000 }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "ConnectorsServiceTaskDefTaskRole80C55FB4" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Connectors/Service/Service/SecurityGroup/from BrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE:3000" } }, "ConnectorsServiceTaskCountTargetA437E32E": { "Type": "AWS::ApplicationAutoScaling::ScalableTarget", "Properties": { "MaxCapacity": 4, "MinCapacity": 1, "ResourceId": { "Fn::Join": [ "", [ "service/", { "Ref": "ClusterEB0386A7" }, "/", { "Fn::GetAtt": [ "ConnectorsService856813DF", "Name" ] } ] ] }, "RoleARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService" ] ] }, "ScalableDimension": "ecs:service:DesiredCount", "ServiceNamespace": "ecs" }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "ConnectorsServiceTaskDefTaskRole80C55FB4" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Connectors/Service/Service/TaskCount/Target/Resource" } }, "ConnectorsServiceTaskCountTargetCpu38350A22": { "Type": "AWS::ApplicationAutoScaling::ScalingPolicy", "Properties": { "PolicyName": "BrainbaseApplianceConnectorsServiceTaskCountTargetCpu2CCD2111", "PolicyType": "TargetTrackingScaling", "ScalingTargetId": { "Ref": "ConnectorsServiceTaskCountTargetA437E32E" }, "TargetTrackingScalingPolicyConfiguration": { "PredefinedMetricSpecification": { "PredefinedMetricType": "ECSServiceAverageCPUUtilization" }, "TargetValue": 60 } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "ConnectorsServiceTaskDefTaskRole80C55FB4" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Connectors/Service/Service/TaskCount/Target/Cpu/Resource" } }, "ConnectorsServiceTg227875E2": { "Type": "AWS::ElasticLoadBalancingV2::TargetGroup", "Properties": { "HealthCheckPath": "/health", "Port": 3000, "Protocol": "HTTP", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TargetGroupAttributes": [ { "Key": "deregistration_delay.timeout_seconds", "Value": "15" }, { "Key": "stickiness.enabled", "Value": "false" } ], "TargetType": "ip", "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Connectors/Service/Tg/Resource" } }, "ClientServiceTaskDefTaskRoleCA241F6A": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Client/Service/TaskDef/TaskRole/Resource" } }, "ClientServiceTaskDef137FC44B": { "Type": "AWS::ECS::TaskDefinition", "Properties": { "ContainerDefinitions": [ { "Environment": [ { "Name": "NEXT_PUBLIC_RUNTIME_CONFIG", "Value": "1" }, { "Name": "SUPABASE_URL", "Value": { "Fn::Join": [ "", [ "https://supabase.", { "Ref": "DomainName" } ] ] } }, { "Name": "MANAGED_AGENTS_URL", "Value": { "Fn::Join": [ "", [ "https://api.", { "Ref": "DomainName" } ] ] } }, { "Name": "APP_URL", "Value": { "Fn::Join": [ "", [ "https://app.", { "Ref": "DomainName" } ] ] } }, { "Name": "BASE_URL", "Value": { "Fn::Join": [ "", [ "https://app.", { "Ref": "DomainName" } ] ] } }, { "Name": "API_URL", "Value": { "Fn::Join": [ "", [ "https://llm.", { "Ref": "DomainName" } ] ] } }, { "Name": "LLM_SERVICE_URL", "Value": { "Fn::Join": [ "", [ "https://llm.", { "Ref": "DomainName" } ] ] } }, { "Name": "CONNECTORS_URL", "Value": { "Fn::Join": [ "", [ "https://hooks.", { "Ref": "DomainName" } ] ] } }, { "Name": "GITHUB_CONNECTORS_URL", "Value": "https://brainbase-github-connectors.onrender.com" }, { "Name": "MODEL_ALLOWLIST", "Value": "claude-sonnet-5,claude-opus-5,claude-opus-4-8,claude-opus-4-7,gpt-5.6-sol,gpt-5.6-terra,gpt-5.6-luna,-auto:open" }, { "Name": "AWS_MICROVM_ENABLED", "Value": "true" }, { "Name": "DEFAULT_MACHINE_KIND", "Value": "aws_microvm" }, { "Name": "POSTHOG_HOST", "Value": "https://us.i.posthog.com" }, { "Name": "DEPLOY_ENV", "Value": "production" }, { "Name": "KAFKA_LLM_SERVICE_URL", "Value": { "Fn::Join": [ "", [ "https://llm.", { "Ref": "DomainName" } ] ] } }, { "Name": "WORKFLOW_SERVICE_URL", "Value": "https://workflows.workforce.brainbaselabs.com" }, { "Name": "MCP_AUTH_ISSUER", "Value": "https://app.brainbaselabs.com" }, { "Name": "MCP_AUTH_AUDIENCE", "Value": "brainbase-mcp" }, { "Name": "MCP_AUTH_RESOURCE", "Value": { "Fn::Join": [ "", [ "https://api.", { "Ref": "DomainName" } ] ] } }, { "Name": "PIPEDREAM_PROJECT_ENVIRONMENT", "Value": "production" }, { "Name": "PIPEDREAM_ALLOWED_ORIGINS", "Value": { "Fn::Join": [ "", [ "[\"https://app.", { "Ref": "DomainName" }, "\"]" ] ] } }, { "Name": "BILLING_MODE", "Value": "marketplace" } ], "Essential": true, "Image": "709825985650.dkr.ecr.us-east-1.amazonaws.com/brainbase-labs/bb2-client:sha-c310557810d3-20d951a7", "LogConfiguration": { "LogDriver": "awslogs", "Options": { "awslogs-group": { "Ref": "ClientServiceLogs33C68BCF" }, "awslogs-stream-prefix": "client", "awslogs-region": { "Ref": "AWS::Region" } } }, "Name": "app", "PortMappings": [ { "ContainerPort": 3000, "Protocol": "tcp" } ], "Secrets": [ { "Name": "SUPABASE_ANON_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":ANON_KEY::" ] ] } }, { "Name": "SUPABASE_SERVICE_ROLE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "SupabaseSecretsSecret6D32C82D" }, ":SERVICE_ROLE_KEY::" ] ] } }, { "Name": "BRAINBASE_DATA_KEY_V1", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":BRAINBASE_DATA_KEY_V1::" ] ] } }, { "Name": "KAFKA_LLM_SERVICE_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":LLM_SERVICE_KEY::" ] ] } }, { "Name": "MCP_AUTH_SHARED_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":MCP_AUTH_SHARED_SECRET::" ] ] } }, { "Name": "ORCH_TRIGGER_FIRES_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":ORCH_TRIGGER_FIRES_SECRET::" ] ] } }, { "Name": "CUSTOM_ACCESS_TOKEN_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":CUSTOM_ACCESS_TOKEN_SECRET::" ] ] } }, { "Name": "NOTIFICATION_API_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":NOTIFICATION_API_SECRET::" ] ] } }, { "Name": "STRIPE_SECRET_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":STRIPE_SECRET_KEY::" ] ] } }, { "Name": "RESEND_API_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":RESEND_API_KEY::" ] ] } }, { "Name": "LIVEKIT_URL", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":LIVEKIT_URL::" ] ] } }, { "Name": "LIVEKIT_API_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":LIVEKIT_API_KEY::" ] ] } }, { "Name": "LIVEKIT_API_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":LIVEKIT_API_SECRET::" ] ] } }, { "Name": "LIVEKIT_SIP_DOMAIN", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":LIVEKIT_SIP_DOMAIN::" ] ] } }, { "Name": "DEEPGRAM_API_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":DEEPGRAM_API_KEY::" ] ] } }, { "Name": "TWILIO_ACCOUNT_SID", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":TWILIO_ACCOUNT_SID::" ] ] } }, { "Name": "TWILIO_AUTH_TOKEN", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":TWILIO_AUTH_TOKEN::" ] ] } }, { "Name": "TWILIO_VERIFY_SERVICE_SID", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":TWILIO_VERIFY_SERVICE_SID::" ] ] } }, { "Name": "PIPEDREAM_CLIENT_ID", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":PIPEDREAM_CLIENT_ID::" ] ] } }, { "Name": "PIPEDREAM_CLIENT_SECRET", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":PIPEDREAM_CLIENT_SECRET::" ] ] } }, { "Name": "PIPEDREAM_PROJECT_ID", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":PIPEDREAM_PROJECT_ID::" ] ] } }, { "Name": "PORTKEY_API_KEY", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":PORTKEY_API_KEY::" ] ] } }, { "Name": "PLATFORM_ANTHROPIC_VK", "ValueFrom": { "Fn::Join": [ "", [ { "Ref": "AppSecretsSecretBC39ACDC" }, ":PLATFORM_ANTHROPIC_VK::" ] ] } } ] } ], "Cpu": "1024", "ExecutionRoleArn": { "Fn::GetAtt": [ "ClientServiceTaskDefExecutionRole64DC4EE3", "Arn" ] }, "Family": "bb-appliance-client", "Memory": "2048", "NetworkMode": "awsvpc", "RequiresCompatibilities": [ "FARGATE" ], "RuntimePlatform": { "CpuArchitecture": "ARM64" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskRoleArn": { "Fn::GetAtt": [ "ClientServiceTaskDefTaskRoleCA241F6A", "Arn" ] } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Client/Service/TaskDef/Resource" } }, "ClientServiceTaskDefExecutionRole64DC4EE3": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Client/Service/TaskDef/ExecutionRole/Resource" } }, "ClientServiceTaskDefExecutionRoleDefaultPolicyCC74637B": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "ClientServiceLogs33C68BCF", "Arn" ] } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "SupabaseSecretsSecret6D32C82D" } }, { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Effect": "Allow", "Resource": { "Ref": "AppSecretsSecretBC39ACDC" } } ], "Version": "2012-10-17" }, "PolicyName": "ClientServiceTaskDefExecutionRoleDefaultPolicyCC74637B", "Roles": [ { "Ref": "ClientServiceTaskDefExecutionRole64DC4EE3" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Client/Service/TaskDef/ExecutionRole/DefaultPolicy/Resource" } }, "ClientServiceLogs33C68BCF": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": "/bb-appliance/client", "RetentionInDays": 30, "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ] }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Client/Service/Logs/Resource" } }, "ClientServiceB1B4D251": { "Type": "AWS::ECS::Service", "Properties": { "Cluster": { "Ref": "ClusterEB0386A7" }, "DeploymentConfiguration": { "Alarms": { "AlarmNames": [], "Enable": false, "Rollback": false }, "DeploymentCircuitBreaker": { "Enable": true, "Rollback": true }, "MaximumPercent": 200, "MinimumHealthyPercent": 50 }, "DeploymentController": { "Type": "ECS" }, "DesiredCount": 1, "EnableECSManagedTags": false, "HealthCheckGracePeriodSeconds": 60, "LaunchType": "FARGATE", "LoadBalancers": [ { "ContainerName": "app", "ContainerPort": 3000, "TargetGroupArn": { "Ref": "ClientServiceTgB9C17B78" } } ], "NetworkConfiguration": { "AwsvpcConfiguration": { "AssignPublicIp": "DISABLED", "SecurityGroups": [ { "Fn::GetAtt": [ "ClientServiceSecurityGroup0E2FD644", "GroupId" ] } ], "Subnets": [ { "Ref": "NetworkVpcappSubnet1SubnetE208FB5D" }, { "Ref": "NetworkVpcappSubnet2SubnetC46F4198" } ] } }, "ServiceName": "bb-appliance-client", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TaskDefinition": { "Ref": "ClientServiceTaskDef137FC44B" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "ClientServiceTaskDefTaskRoleCA241F6A", "EdgeAlbHttpsclientRuleRule5A92A289" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Client/Service/Service/Service" } }, "ClientServiceSecurityGroup0E2FD644": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "BrainbaseAppliance/Client/Service/Service/SecurityGroup", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "ClientServiceTaskDefTaskRoleCA241F6A" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Client/Service/Service/SecurityGroup/Resource" } }, "ClientServiceSecurityGroupfromBrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE300079944FF8": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "Description": "Load balancer to target", "FromPort": 3000, "GroupId": { "Fn::GetAtt": [ "ClientServiceSecurityGroup0E2FD644", "GroupId" ] }, "IpProtocol": "tcp", "SourceSecurityGroupId": { "Fn::GetAtt": [ "EdgeAlbSecurityGroup529778D4", "GroupId" ] }, "ToPort": 3000 }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "ClientServiceTaskDefTaskRoleCA241F6A" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Client/Service/Service/SecurityGroup/from BrainbaseApplianceEdgeAlbSecurityGroupCC0C9FFE:3000" } }, "ClientServiceTaskCountTarget26871372": { "Type": "AWS::ApplicationAutoScaling::ScalableTarget", "Properties": { "MaxCapacity": 4, "MinCapacity": 1, "ResourceId": { "Fn::Join": [ "", [ "service/", { "Ref": "ClusterEB0386A7" }, "/", { "Fn::GetAtt": [ "ClientServiceB1B4D251", "Name" ] } ] ] }, "RoleARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService" ] ] }, "ScalableDimension": "ecs:service:DesiredCount", "ServiceNamespace": "ecs" }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "ClientServiceTaskDefTaskRoleCA241F6A" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Client/Service/Service/TaskCount/Target/Resource" } }, "ClientServiceTaskCountTargetCpu8C4BDE4D": { "Type": "AWS::ApplicationAutoScaling::ScalingPolicy", "Properties": { "PolicyName": "BrainbaseApplianceClientServiceTaskCountTargetCpu09FAC7F1", "PolicyType": "TargetTrackingScaling", "ScalingTargetId": { "Ref": "ClientServiceTaskCountTarget26871372" }, "TargetTrackingScalingPolicyConfiguration": { "PredefinedMetricSpecification": { "PredefinedMetricType": "ECSServiceAverageCPUUtilization" }, "TargetValue": 60 } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676", "ClientServiceTaskDefTaskRoleCA241F6A" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Client/Service/Service/TaskCount/Target/Cpu/Resource" } }, "ClientServiceTgB9C17B78": { "Type": "AWS::ElasticLoadBalancingV2::TargetGroup", "Properties": { "HealthCheckPath": "/", "Matcher": { "HttpCode": "200-499" }, "Port": 3000, "Protocol": "HTTP", "Tags": [ { "Key": "brainbase-appliance", "Value": "v1" } ], "TargetGroupAttributes": [ { "Key": "deregistration_delay.timeout_seconds", "Value": "15" }, { "Key": "stickiness.enabled", "Value": "false" } ], "TargetType": "ip", "VpcId": { "Ref": "NetworkVpc7FB7348F" } }, "DependsOn": [ "AppSecretsDirectCustomResource73AD5D45", "BaselineBootstrap8576F676" ], "Metadata": { "aws:cdk:path": "BrainbaseAppliance/Client/Service/Tg/Resource" } }, "CDKMetadata": { "Type": "AWS::CDK::Metadata", "Properties": { "Analytics": "v2:deflate64:H4sIAAAAAAAA/4VVwW7bOBD9lt4Z7sLZ7d2xk8JA2hpWmh6LETVWJqZIgRzaMAT9e0FSlmQ32D3xvcfRzHj4SC/k4vM/8u9PcPJ3qjrcaSplVzCog1jtzRYcNMjoBJz8rw7VQnavrYpbr9uV2IZSkypCaZCjNqGdDYwvUGqc9Elbem8VAZM1Y3AEj5ttXL4BfwHGE5zF1tERGKfEG8PoDI4BuZOBLZlBvTVoWBSogiM+f3E2tKmH/xQea4fei43xDEZhrjTgV6tDk6RbNKt3m3BjUsZeoAbPpLSFqgQNRpGpjwvZLdtWk0ozeLZQPaQ9dDHRFZ/HkWc0Q8wFf7C/Qse0jyLOQ+fyB1/tgr4KT3wW9wKuRh7HN6O9UFPqBgzU6GR308WM9sLFE//3XnbLHSrrquSChApksQSAzHpB0MhuZ3Nrad1aTSod/IQuZ7V1dk8axQ+fpxTXXmhoygpk9xSMunhuxI9HNLwxR3vAlTV7qpMR/xDXVh3QbRqo8fJpL1B52a108JzLXeATuBqi1/1hjXsydKl6q1jDQAbdTBu+LdAdKRvxAgsFOt6emGRlg+Fe+LxVkVf2iO4su+HCrI3/Bg36FnKOD+TYvpPdDlvria0750MY2QQfwGMvlK2wDKSrWMS+o+KcOMHYinLIfjz+IvHhXjiMEfeyewjqkNUB5WU6yTnvRaUbmSy5R3VWGoc4bWsvu2dbj24c8VdkR+qJ9HAkc94LmOwMga1XoMnUsptGG02dmr5W8vLiQB3I1EX+bur6SoiziL5IxgkuVSty1j+1GyEZb42eyYzP4//GPDZAelOhYeLUzpXQC2+87F5sS+nhzqAIpVeO2kuRK55Cpl83o71Q2obqBKzeZLfU4JoYMQDbJMvgqN8oa/BvpYV830fSixPs45MYL/J2mNRPLJer5wnN/jJ64dUbVkGjk2n2mfRih94Glw3/PXAbWKyCZ9vMN67w8OR9hbYlUw/DrihXMbZC+e7/Oi4WcnEvF5/ePdGdC4apQbnL628fE9NSQAcAAA==" }, "Metadata": { "aws:cdk:path": "BrainbaseAppliance/CDKMetadata/Default" }, "Condition": "CDKMetadataAvailable" } }, "Outputs": { "AlbDnsName": { "Value": { "Fn::GetAtt": [ "EdgeAlb09518372", "DNSName" ] } }, "BaselineBootstrapSchemaLedgerHead25FF4D62": { "Description": "Last applied migration in this appliance's bb_migrate ledger (empty = baseline only)", "Value": { "Fn::GetAtt": [ "BaselineBootstrap8576F676", "LedgerHead" ] } } }, "Rules": { "RegistryRegion": { "Assertions": [ { "Assert": { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-1" ] }, "AssertDescription": "This stack must be created in us-east-1: its images live in the AWS Marketplace registry 709825985650.dkr.ecr.us-east-1.amazonaws.com, which serves that region only (cross-region delivery is a later increment)." } ] } }, "Mappings": { "PostgresPostgresAmiByRegion20715B83": { "us-east-1": { "ami": "ami-068e33c5263812a9b" }, "us-east-2": { "ami": "ami-0bcfd831142b1e259" }, "us-west-1": { "ami": "ami-05a32a9b0755b8890" }, "us-west-2": { "ami": "ami-0b682cbd2c343e420" }, "ap-south-1": { "ami": "ami-0cf06b773a75b8476" }, "ap-northeast-1": { "ami": "ami-058dc8374ad18585e" }, "ap-northeast-2": { "ami": "ami-0b17a6ff7625a7364" }, "ap-southeast-1": { "ami": "ami-094ee45754c68a2db" }, "ap-southeast-2": { "ami": "ami-04d21ec89688bc478" }, "ca-central-1": { "ami": "ami-073fddea2706435a5" }, "eu-central-1": { "ami": "ami-08fc4c4ea7698601f" }, "eu-west-1": { "ami": "ami-0c941aaee6f2de47e" }, "eu-west-2": { "ami": "ami-06e7624a7500d11e9" }, "eu-west-3": { "ami": "ami-030cf5060f6f06a2d" }, "eu-north-1": { "ami": "ami-0a88fa08eb7f2177e" }, "sa-east-1": { "ami": "ami-070c43a5bbe1d33c9" } } }, "Conditions": { "AppAllowListProvided": { "Fn::Not": [ { "Fn::Equals": [ { "Fn::Join": [ "", { "Ref": "AppAllowedCidrs" } ] }, "" ] } ] }, "CDKMetadataAvailable": { "Fn::Or": [ { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "af-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-3" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-4" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-northwest-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-2" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "il-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "sa-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-1" ] } ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-2" ] } ] } } }