Aws private api deployment

.gitignore

@@ -108,3 +108,4 @@ ENV/
 cdk.out/
 deployment/k8s/titiler/values-test.yaml
 docs/src/api/
+.idea

deployment/aws/cdk/app.py

@@ -1,7 +1,7 @@
 """Construct App."""
 
 import os
-from typing import Any, Dict, List, Optional, Union
+from typing import Any, Dict, List, Optional, Union, cast
 
 from aws_cdk import App, CfnOutput, Duration, Stack, Tags
 from aws_cdk import aws_apigatewayv2_alpha as apigw
@@ -11,13 +11,108 @@
 from aws_cdk import aws_iam as iam
 from aws_cdk import aws_lambda
 from aws_cdk import aws_logs as logs
+from aws_cdk.aws_apigateway import (
+    EndpointConfiguration,
+    EndpointType,
+    LambdaIntegration,
+    RestApi,
+)
 from aws_cdk.aws_apigatewayv2_integrations_alpha import HttpLambdaIntegration
+from aws_cdk.aws_iam import AnyPrincipal, Effect, PolicyDocument, PolicyStatement
 from config import StackSettings
 from constructs import Construct
 
 settings = StackSettings()
 
 
+class TitilerPrivateApiStack(Stack):
+    """
+    Titiler Private API Stack
+
+    Private api configuration for titiler.
+
+    author: @jeandsmith
+    """
+
+    def __init__(
+        self,
+        scope: Construct,
+        id: str,
+        vpc_endpoint_id: str,
+        memory: int = 1024,
+        timeout: int = 30,
+        runtime: aws_lambda.Runtime = aws_lambda.Runtime.PYTHON_3_11,
+        code_dir: str = "./",
+        concurrent: Optional[int] = None,
+        permissions: Optional[List[iam.PolicyStatement]] = None,
+        environment: Optional[Dict] = None,
+        **kwargs: Any,
+    ) -> None:
+        """Define the stack"""
+        super().__init__(scope, id, **kwargs)
+
+        permissions = permissions or []
+        environment = environment or {}
+
+        lambda_function = aws_lambda.Function(
+            self,
+            f"{id}-lambda",
+            runtime=runtime,
+            code=aws_lambda.Code.from_docker_build(
+                path=os.path.abspath(code_dir),
+                file="lambda/Dockerfile",
+            ),
+            handler="handler.handler",
+            memory_size=memory,
+            reserved_concurrent_executions=concurrent,
+            timeout=Duration.seconds(timeout),
+            environment=environment,
+            log_retention=logs.RetentionDays.ONE_WEEK,
+        )
+
+        for perm in permissions:
+            lambda_function.add_to_role_policy(perm)
+
+        api = RestApi(
+            self,
+            f"{id}-endpoint",
+            default_integration=LambdaIntegration(
+                handler=cast(aws_lambda.IFunction, lambda_function)
+            ),
+            policy=PolicyDocument(
+                statements=[
+                    PolicyStatement(
+                        principals=[AnyPrincipal()],
+                        effect=Effect.DENY,
+                        actions=["execute-api:Invoke"],
+                        resources=[
+                            Stack.of(self).format_arn(
+                                service="execute-api", resource="*"
+                            )
+                        ],
+                        conditions={
+                            "StringNotEquals": {"aws:SourceVpce": vpc_endpoint_id}
+                        },
+                    ),
+                    PolicyStatement(
+                        principals=[AnyPrincipal()],
+                        effect=Effect.ALLOW,
+                        actions=["execute-api:Invoke"],
+                        resources=[
+                            Stack.of(self).format_arn(
+                                service="execute-api", resource="*"
+                            )
+                        ],
+                    ),
+                ]
+            ),
+            endpoint_configuration=EndpointConfiguration(types=[EndpointType.PRIVATE]),
+        )
+        api.root.add_proxy()
+
+        CfnOutput(self, "Endpoint", value=api.url)
+
+
 class titilerLambdaStack(Stack):
     """
     Titiler Lambda Stack
@@ -175,6 +270,16 @@ def __init__(
         )
     )
 
+private_api = TitilerPrivateApiStack(
+    app,
+    f"{settings.name}-private-api-{settings.stage}",
+    vpc_endpoint_id=settings.vpc_endpoint_id,
+    memory=settings.memory,
+    timeout=settings.timeout,
+    concurrent=settings.max_concurrent,
+    permissions=perms,
+    environment=settings.env,
+)
 
 ecs_stack = titilerECSStack(
     app,
@@ -197,6 +302,7 @@ def __init__(
     environment=settings.env,
 )
 
+
 # Tag infrastructure
 for key, value in {
     "Project": settings.name,
@@ -207,6 +313,7 @@ def __init__(
     if value:
         Tags.of(ecs_stack).add(key, value)
         Tags.of(lambda_stack).add(key, value)
+        Tags.of(private_api).add(key, value)
 
 
 app.synth()

deployment/aws/cdk/config.py

@@ -85,4 +85,7 @@ class StackSettings(BaseSettings):
     # Default: - No specific limit - account limit.
     max_concurrent: Optional[int] = None
 
+    # The VPC Endpoint ID
+    vpc_endpoint_id: str = "{{VPCE_ID}}"
+
     model_config = SettingsConfigDict(env_prefix="TITILER_STACK_", env_file=".env")

deployment/aws/cdk/read.14868.1.lock

@@ -0,0 +1 @@
+14868