bootstrap-props.ts

import type { BootstrapSource } from './bootstrap-environment';
import type { StringWithoutPlaceholders } from '../environment';
import type { Tag } from '../tags';

export const BUCKET_NAME_OUTPUT = 'BucketName';
export const REPOSITORY_NAME_OUTPUT = 'ImageRepositoryName';
export const BUCKET_DOMAIN_NAME_OUTPUT = 'BucketDomainName';
export const BOOTSTRAP_VERSION_OUTPUT = 'BootstrapVersion';
export const BOOTSTRAP_VERSION_RESOURCE = 'CdkBootstrapVersion';
export const BOOTSTRAP_VARIANT_PARAMETER = 'BootstrapVariant';

/**
 * The assumed vendor of a template in case it is not set
 */
export const DEFAULT_BOOTSTRAP_VARIANT = 'AWS CDK: Default Resources';

/**
 * Options for the bootstrapEnvironment operation(s)
 */
export interface BootstrapEnvironmentOptions {
  readonly toolkitStackName?: string;
  readonly roleArn?: StringWithoutPlaceholders;
  readonly parameters?: BootstrappingParameters;
  readonly forceDeployment?: boolean;

  /**
   * The source of the bootstrap stack
   *
   * @default - Modern v2-style bootstrapping
   */
  readonly source?: BootstrapSource;

  /**
   * Whether to execute the changeset or only create it and leave it in review.
   * @default true
   */
  readonly execute?: boolean;

  /**
   * Tags for cdktoolkit stack.
   *
   * @default - No value, optional argument
   */
  readonly tags?: Tag[];

  /**
   * Whether the stacks created by the bootstrap process should be protected from termination.
   * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-protect-stacks.html
   * @default true
   */
  readonly terminationProtection?: boolean;

  /**
   * Use previous values for unspecified parameters
   *
   * If not set, all parameters must be specified for every deployment.
   *
   * @default true
   */
  usePreviousParameters?: boolean;
}

/**
 * Parameters for the bootstrapping template
 */
export interface BootstrappingParameters {
  /**
   * The name to be given to the CDK Bootstrap bucket.
   *
   * @default - A name is generated by CloudFormation
   */
  readonly bucketName?: string;

  /**
   * The ID of an existing KMS key to be used for encrypting items in the bucket.
   *
   * @default - Use the default KMS key or create a custom one
   */
  readonly kmsKeyId?: string;

  /**
   * Whether or not to create a new customer master key (CMK)
   *
   * Only applies to modern bootstrapping. Legacy bootstrapping will never create
   * a CMK, only use the default S3 key.
   *
   * @default false
   */
  readonly createCustomerMasterKey?: boolean;

  /**
   * The list of AWS account IDs that are trusted to deploy into the environment being bootstrapped.
   *
   * @default - Only the bootstrapped account can deploy into this environment
   */
  readonly trustedAccounts?: string[];

  /**
   * The list of AWS account IDs that are trusted to look up values in the environment being bootstrapped.
   *
   * @default - Only the bootstrapped account can look up values in this environment
   */
  readonly trustedAccountsForLookup?: string[];

  /**
   * The list of AWS account IDs that should not be trusted by the bootstrapped environment.
   * If these accounts are already trusted, they will be removed on bootstrapping.
   *
   * @default - No account will be untrusted
   */
  readonly untrustedAccounts?: string[];

  /**
   * The ARNs of the IAM managed policies that should be attached to the role performing CloudFormation deployments.
   * In most cases, this will be the AdministratorAccess policy.
   * At least one policy is required if `trustedAccounts` were passed.
   *
   * @default - The role will have no policies attached
   */
  readonly cloudFormationExecutionPolicies?: string[];

  /**
   * Identifier to distinguish multiple bootstrapped environments
   *
   * @default - Default qualifier
   */
  readonly qualifier?: string;

  /**
   * Whether or not to enable S3 Staging Bucket Public Access Block Configuration
   *
   * @default true
   */
  readonly publicAccessBlockConfiguration?: boolean;

  /**
   * Flag for using the default permissions boundary for bootstrapping
   *
   * @default - No value, optional argument
   */
  readonly examplePermissionsBoundary?: boolean;

  /**
   * Name for the customer's custom permissions boundary for bootstrapping
   *
   * @default - No value, optional argument
   */
  readonly customPermissionsBoundary?: string;

  /**
   * Whether to apply the permissions boundary to all bootstrap roles
   * (not just the CloudFormation execution role)
   *
   * @default false
   */
  readonly permissionsBoundaryAllRoles?: boolean;

  /**
   * Whether to deny AssumeRole calls with an ExternalId
   *
   * @default - template default (true)
   */
  readonly denyExternalId?: boolean;
}