feat: add patch manager IaC

cdk/PatchManager.ts

@@ -0,0 +1,87 @@
+import { Stack, StackProps } from 'aws-cdk-lib';
+import * as ssm from 'aws-cdk-lib/aws-ssm';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import { Construct } from 'constructs';
+
+export class PatchManagerStack extends Stack {
+  constructor(scope: Construct, id: string, props: Props) {
+    super(scope, id, props);
+
+    // IAM role used by the maintenance window
+    const maintenanceRole = new iam.Role(this, 'MaintenanceWindowRole', {
+      assumedBy: new iam.ServicePrincipal('ssm.amazonaws.com'),
+    });
+
+    maintenanceRole.addToPolicy(
+      new iam.PolicyStatement({
+        actions: [
+          'ssm:SendCommand',
+          'ssm:ListCommands',
+          'ssm:ListCommandInvocations',
+        ],
+        resources: ['*'],
+      }),
+    );
+
+    // Maintenance Window
+    const maintenanceWindow = new ssm.CfnMaintenanceWindow(
+      this,
+      'PatchMaintenanceWindow',
+      {
+        name: 'patch-maintenance-window',
+        description: 'Weekly patching using AWS default patch baseline',
+        schedule: 'cron(0 7 ? * WED *)', // Wednesdays 07:00 UTC
+        duration: 3,
+        cutoff: 1,
+        allowUnassociatedTargets: false,
+      },
+    );
+
+    // Target EC2 instances by Name tag
+    const target = new ssm.CfnMaintenanceWindowTarget(
+      this,
+      'PatchTarget',
+      {
+        windowId: maintenanceWindow.ref,
+        resourceType: 'INSTANCE',
+        targets: [
+          {
+            key: 'InstanceIds',
+            values: [...props.instanceIds],
+          },
+        ],
+      },
+    );
+
+    // Patch task (Install)
+    new ssm.CfnMaintenanceWindowTask(this, 'PatchInstallTask', {
+      windowId: maintenanceWindow.ref,
+      taskArn: 'AWS-RunPatchBaseline',
+      taskType: 'RUN_COMMAND',
+      priority: 1,
+      maxConcurrency: '2',
+      maxErrors: '1',
+      serviceRoleArn: maintenanceRole.roleArn,
+      targets: [
+        {
+          key: 'WindowTargetIds',
+          values: [target.ref],
+        },
+      ],
+      taskInvocationParameters: {
+        maintenanceWindowRunCommandParameters: {
+          parameters: {
+            Operation: ['Install'],
+          },
+        },
+      },
+    });
+  }
+}
+
+export interface Props extends StackProps {
+  /**
+   * Instance IDs to target for patching.
+   */
+  instanceIds: string[];
+}

cdk/PgStacInfra.ts

@@ -27,6 +27,7 @@ import { load } from "js-yaml";
 import { DpsStacItemGenerator } from "./constructs/DpsStacItemGenerator";
 
 export class PgStacInfra extends Stack {
+  public readonly pgbouncerInstanceId: string;
   constructor(scope: Construct, id: string, props: Props) {
     super(scope, id, props);
 
@@ -68,6 +69,9 @@ export class PgStacInfra extends Stack {
       customResourceProperties: { context: true },
       bootstrapperLambdaFunctionOptions: { timeout: Duration.minutes(15) },
     });
+    if (pgstacDb.pgbouncerInstanceId) {
+      this.pgbouncerInstanceId = pgstacDb.pgbouncerInstanceId;
+    }
 
     const apiSubnetSelection: ec2.SubnetSelection = {
       subnetType: pgstacDbConfig.subnetPublic

cdk/app.ts

@@ -6,6 +6,7 @@ import { Vpc } from "./Vpc";
 import { Config } from "./config";
 import { PgStacInfra } from "./PgStacInfra";
 import { MaapEoapiCommon } from "./MaapEoapiCommon";
+import { PatchManagerStack } from "./PatchManager";
 
 const {
   buildStackName,
@@ -49,7 +50,7 @@ const common = new MaapEoapiCommon(app, buildStackName("common"), {
   terminationProtection: false,
 });
 
-new PgStacInfra(app, buildStackName("pgSTAC"), {
+const coreInfrastructure = new PgStacInfra(app, buildStackName("pgSTAC"), {
   vpc,
   tags,
   stage,
@@ -89,7 +90,7 @@ new PgStacInfra(app, buildStackName("pgSTAC"), {
   terminationProtection: false,
 });
 
-new PgStacInfra(app, buildStackName("userSTAC"), {
+const userInfrastructure = new PgStacInfra(app, buildStackName("userSTAC"), {
   vpc,
   tags,
   stage,
@@ -127,3 +128,11 @@ new PgStacInfra(app, buildStackName("userSTAC"), {
   }),
   terminationProtection: false,
 });
+
+new PatchManagerStack(app, buildStackName("patch-manager"), {
+  instanceIds: [
+    coreInfrastructure.pgbouncerInstanceId,
+    userInfrastructure.pgbouncerInstanceId,
+  ],
+  terminationProtection: false,
+});