chore(infra): analytics integ test gen 2 backend (#5104)

infra-gen2/backends/analytics/main/.gitignore

@@ -0,0 +1,5 @@
+# amplify
+node_modules
+.amplify
+amplify_outputs*
+amplifyconfiguration*

infra-gen2/backends/analytics/main/amplify/auth/pre-sign-up-handler.ts

@@ -0,0 +1,4 @@
+import { PreSignUpTriggerHandler } from "aws-lambda";
+import { preSignUpTriggerHandler } from "infra-common";
+
+export const handler: PreSignUpTriggerHandler = preSignUpTriggerHandler;

infra-gen2/backends/analytics/main/amplify/auth/resource.ts

@@ -0,0 +1,19 @@
+import { defineAuth, defineFunction } from "@aws-amplify/backend";
+
+export const preSignUp = defineFunction({
+  name: "pre-sign-up",
+  entry: "./pre-sign-up-handler.ts",
+});
+
+/**
+ * Define and configure your auth resource
+ * @see https://docs.amplify.aws/gen2/build-a-backend/auth
+ */
+export const auth = defineAuth({
+  loginWith: {
+    email: true,
+  },
+  triggers: {
+    preSignUp,
+  },
+});

infra-gen2/backends/analytics/main/amplify/backend.ts

@@ -0,0 +1,28 @@
+import { defineBackend } from "@aws-amplify/backend";
+import { addAnalyticsExtensions } from "infra-common";
+import { auth } from "./auth/resource";
+
+/**
+ * @see https://docs.amplify.aws/react/build-a-backend/ to add storage, functions, and more
+ */
+
+const backend = defineBackend({
+  auth,
+});
+
+const pinpointRole = backend.auth.resources.authenticatedUserIamRole;
+const unauthPinpointRole = backend.auth.resources.unauthenticatedUserIamRole;
+
+const resources = backend.auth.resources;
+const { userPool, cfnResources } = resources;
+const { stack } = userPool;
+
+const customOutputs = addAnalyticsExtensions({
+  name: "analytics-main",
+  stack: stack,
+  authenticatedRole: pinpointRole,
+  unauthenticatedRole: unauthPinpointRole,
+});
+
+// patch the custom Pinpoint resource to the expected output configuration
+backend.addOutput(customOutputs);

infra-gen2/backends/analytics/main/amplify/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

infra-gen2/backends/analytics/main/amplify/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "es2022",
+    "module": "es2022",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "paths": {
+      "$amplify/*": [
+        "../.amplify/generated/*"
+      ]
+    }
+  }
+}

infra-gen2/backends/analytics/main/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "analytics-main",
+  "version": "1.0.0",
+  "main": "index.js"
+}

infra-gen2/backends/analytics/main/schema.graphql

@@ -0,0 +1,22 @@
+type Query {
+  getRecord(id: ID!): Record @aws_api_key
+  listRecords: [Record] @aws_api_key
+}
+
+type Mutation {
+  createRecord(input: RecordInput!): Record @aws_api_key
+}
+
+type Subscription {
+  onCreateRecord: Record @aws_subscribe(mutations: ["createRecord"])
+}
+
+type Record {
+  id: ID!
+  payload: String!
+}
+
+input RecordInput {
+  id: ID!
+  payload: String!
+}

infra-gen2/backends/analytics/no-unauth-access/.gitignore

@@ -0,0 +1,5 @@
+# amplify
+node_modules
+.amplify
+amplify_outputs*
+amplifyconfiguration*

infra-gen2/backends/analytics/no-unauth-access/amplify/auth/pre-sign-up-handler.ts

@@ -0,0 +1,4 @@
+import { PreSignUpTriggerHandler } from "aws-lambda";
+import { preSignUpTriggerHandler } from "infra-common";
+
+export const handler: PreSignUpTriggerHandler = preSignUpTriggerHandler;

infra-gen2/backends/analytics/no-unauth-access/amplify/auth/resource.ts

@@ -0,0 +1,19 @@
+import { defineAuth, defineFunction } from "@aws-amplify/backend";
+
+export const preSignUp = defineFunction({
+  name: "pre-sign-up",
+  entry: "./pre-sign-up-handler.ts",
+});
+
+/**
+ * Define and configure your auth resource
+ * @see https://docs.amplify.aws/gen2/build-a-backend/auth
+ */
+export const auth = defineAuth({
+  loginWith: {
+    email: true,
+  },
+  triggers: {
+    preSignUp,
+  },
+});

infra-gen2/backends/analytics/no-unauth-access/amplify/backend.ts

@@ -0,0 +1,26 @@
+import { defineBackend } from "@aws-amplify/backend";
+import { addAnalyticsExtensions } from "infra-common";
+import { auth } from "./auth/resource";
+
+/**
+ * @see https://docs.amplify.aws/react/build-a-backend/ to add storage, functions, and more
+ */
+
+const backend = defineBackend({
+  auth,
+});
+
+const pinpointRole = backend.auth.resources.authenticatedUserIamRole;
+
+const resources = backend.auth.resources;
+const { userPool, cfnResources } = resources;
+const { stack } = userPool;
+
+const customOutputs = addAnalyticsExtensions({
+  name: "analytics-main",
+  stack: stack,
+  authenticatedRole: pinpointRole,
+});
+
+// patch the custom Pinpoint resource to the expected output configuration
+backend.addOutput(customOutputs);

infra-gen2/backends/analytics/no-unauth-access/amplify/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

infra-gen2/backends/analytics/no-unauth-access/amplify/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "es2022",
+    "module": "es2022",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "paths": {
+      "$amplify/*": [
+        "../.amplify/generated/*"
+      ]
+    }
+  }
+}

infra-gen2/backends/analytics/no-unauth-access/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "no-unauth-access",
+  "version": "1.0.0",
+  "main": "index.js"
+}

infra-gen2/backends/analytics/no-unauth-identities/.gitignore

@@ -0,0 +1,5 @@
+# amplify
+node_modules
+.amplify
+amplify_outputs*
+amplifyconfiguration*

infra-gen2/backends/analytics/no-unauth-identities/amplify/auth/pre-sign-up-handler.ts

@@ -0,0 +1,4 @@
+import { PreSignUpTriggerHandler } from "aws-lambda";
+import { preSignUpTriggerHandler } from "infra-common";
+
+export const handler: PreSignUpTriggerHandler = preSignUpTriggerHandler;

infra-gen2/backends/analytics/no-unauth-identities/amplify/auth/resource.ts

@@ -0,0 +1,19 @@
+import { defineAuth, defineFunction } from "@aws-amplify/backend";
+
+export const preSignUp = defineFunction({
+  name: "pre-sign-up",
+  entry: "./pre-sign-up-handler.ts",
+});
+
+/**
+ * Define and configure your auth resource
+ * @see https://docs.amplify.aws/gen2/build-a-backend/auth
+ */
+export const auth = defineAuth({
+  loginWith: {
+    email: true,
+  },
+  triggers: {
+    preSignUp,
+  },
+});

infra-gen2/backends/analytics/no-unauth-identities/amplify/backend.ts

@@ -0,0 +1,31 @@
+import { defineBackend } from "@aws-amplify/backend";
+import { addAnalyticsExtensions } from "infra-common";
+import { auth } from "./auth/resource";
+
+/**
+ * @see https://docs.amplify.aws/react/build-a-backend/ to add storage, functions, and more
+ */
+
+const backend = defineBackend({
+  auth,
+});
+
+const { cfnIdentityPool } = backend.auth.resources.cfnResources;
+cfnIdentityPool.allowUnauthenticatedIdentities = false;
+
+const pinpointRole = backend.auth.resources.authenticatedUserIamRole;
+const unauthPinpointRole = backend.auth.resources.unauthenticatedUserIamRole;
+
+const resources = backend.auth.resources;
+const { userPool, cfnResources } = resources;
+const { stack } = userPool;
+
+const customOutputs = addAnalyticsExtensions({
+  name: "analytics-main",
+  stack: stack,
+  authenticatedRole: pinpointRole,
+  unauthenticatedRole: unauthPinpointRole,
+});
+
+// patch the custom Pinpoint resource to the expected output configuration
+backend.addOutput(customOutputs);

infra-gen2/backends/analytics/no-unauth-identities/amplify/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

infra-gen2/backends/analytics/no-unauth-identities/amplify/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "es2022",
+    "module": "es2022",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "paths": {
+      "$amplify/*": [
+        "../.amplify/generated/*"
+      ]
+    }
+  }
+}

infra-gen2/backends/analytics/no-unauth-identities/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "no-unauth-identities",
+  "version": "1.0.0",
+  "main": "index.js"
+}

infra-gen2/infra-common/src/analytics-extensions/README.md

@@ -0,0 +1,9 @@
+# analytics-extensions
+
+This directory contains extensions for the analytics backend, including:
+
+- Setting up Pinpoint
+- Setting up a Kinesis Data stream and configure Pinpoint to stream events to it
+- Create a Records table to store events from the Kinesis stream
+- Create the GraphQL API to which we will publish Kinesis records
+- Create the Kinesis consumer Lambda which will capture events from the Kinesis Data Stream and forward them to AppSync.

infra-gen2/infra-common/src/analytics-extensions/analytics-extensions.ts

@@ -0,0 +1,47 @@
+import { BackendBase } from "@aws-amplify/backend";
+import { Stack } from "aws-cdk-lib";
+import { IRole } from "aws-cdk-lib/aws-iam";
+import { createAppSyncAPI } from "./data";
+import { createKinesisStream } from "./kinesis";
+import { createPinpointApp } from "./pinpoint";
+
+type AmplifyOutputs = Parameters<BackendBase["addOutput"]>[0];
+
+export const addAnalyticsExtensions = ({
+  name,
+  stack,
+  authenticatedRole,
+  unauthenticatedRole,
+}: {
+  name: string;
+  stack: Stack;
+  authenticatedRole: IRole;
+  unauthenticatedRole?: IRole;
+}): AmplifyOutputs => {
+  const pinpointApp = createPinpointApp(
+    name,
+    stack,
+    authenticatedRole,
+    unauthenticatedRole
+  );
+
+  const kinesisStream = createKinesisStream(name, stack, pinpointApp);
+
+  const graphQLApi = createAppSyncAPI(name, stack, kinesisStream);
+
+  return {
+    analytics: {
+      amazon_pinpoint: {
+        app_id: pinpointApp.ref,
+        aws_region: Stack.of(pinpointApp).region,
+      },
+    },
+    data: {
+      aws_region: stack.region,
+      url: graphQLApi.graphqlUrl,
+      api_key: graphQLApi.apiKey,
+      default_authorization_type: "API_KEY",
+      authorization_types: [],
+    },
+  };
+};