add vpc endpoints

Author: anthony-nhs

.github/workflows/cdk_release_code.yml

@@ -15,6 +15,9 @@ on:
       LOG_RETENTION_IN_DAYS:
         required: true
         type: string
+      DEPLOY_CHANGE:
+        type: boolean
+        default: true
     secrets:
       CLOUD_FORMATION_DEPLOY_ROLE:
         required: true
@@ -107,6 +110,7 @@ jobs:
         shell: bash
 
       - name: Deploy code
+        if: inputs.DEPLOY_CHANGE == 'true'
         run: |
           docker run \
           -v "$(pwd)/.build":/home/cdkuser/workspace/ \

.github/workflows/pull_request.yml

@@ -52,3 +52,22 @@ jobs:
         run: |
           echo "commit_id=${{ github.sha }}" >> "$GITHUB_OUTPUT"
     
+  package_code:
+    needs: [get_issue_number, get_commit_id]
+    uses: ./.github/workflows/cdk_package_code.yml
+    with:
+      VERSION_NUMBER: ${{needs.get_issue_number.outputs.issue_number}}
+      COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
+
+  release_dev:
+    needs: [get_issue_number, package_code, get_commit_id]
+    uses: ./.github/workflows/cdk_release_code.yml
+    with:
+      TARGET_ENVIRONMENT: dev
+      VERSION_NUMBER: ${{needs.get_issue_number.outputs.issue_number}}
+      COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
+      LOG_RETENTION_IN_DAYS: 30
+      DEPLOY_CHANGE: true
+    secrets:
+      CDK_PULL_IMAGE_ROLE: ${{ secrets.DEV_CDK_PULL_IMAGE_ROLE }}
+      CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}

packages/cdk/stacks/VpcResourcesStack.ts

@@ -10,6 +10,7 @@ import {
 import {
   CfnSubnet,
   FlowLogDestination,
+  InterfaceVpcEndpointAwsService,
   IpAddresses,
   Vpc
 } from "aws-cdk-lib/aws-ec2"
@@ -87,6 +88,15 @@ export class VpcResourcesStack extends Stack {
       }
     }
 
+    // add vpc private endpoints
+    vpc.addInterfaceEndpoint("ECRDockerEndpoint", {service: InterfaceVpcEndpointAwsService.ECR_DOCKER})
+    vpc.addInterfaceEndpoint("ECREndpoint", {service: InterfaceVpcEndpointAwsService.ECR})
+    vpc.addInterfaceEndpoint("SecretManagerEndpoint", {service: InterfaceVpcEndpointAwsService.SECRETS_MANAGER})
+    vpc.addInterfaceEndpoint("CloudWatchEndpoint", {service: InterfaceVpcEndpointAwsService.CLOUDWATCH})
+    vpc.addInterfaceEndpoint("CloudWatchLogsEndpoint", {service: InterfaceVpcEndpointAwsService.CLOUDWATCH_LOGS})
+    vpc.addInterfaceEndpoint("CloudWatchEventsEndpoint", {service: InterfaceVpcEndpointAwsService.EVENTBRIDGE})
+    vpc.addInterfaceEndpoint("SSMEndpoint", {service: InterfaceVpcEndpointAwsService.SSM})
+
     //Outputs
 
     //Exports