"use strict";
/*
 *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 *  SPDX-License-Identifier: Apache-2.0
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.RSWApplicationLoadBalancer = void 0;
const aws_elasticloadbalancingv2_1 = require("aws-cdk-lib/aws-elasticloadbalancingv2");
const constructs_1 = require("constructs");
const constants_1 = require("../constants");
class RSWApplicationLoadBalancer extends constructs_1.Construct {
    constructor(scope, id, props) {
        const { vpc, subnets, internetFacing, accessLogsBucket } = props;
        super(scope, id);
        this.applicationLoadBalancer = new aws_elasticloadbalancingv2_1.ApplicationLoadBalancer(this, id, {
            vpc,
            vpcSubnets: subnets,
            internetFacing
        });
        // logAccessLogs() depends on region being specified on the stack, which is only possible during non-Solutions deployment
        if (!(0, constants_1.isSolutionsBuild)()) {
            this.applicationLoadBalancer.logAccessLogs(accessLogsBucket);
        }
        else {
            const albMetadataNode = this.applicationLoadBalancer.node.defaultChild;
            albMetadataNode.addMetadata('cfn_nag', {
                // eslint-disable-next-line @typescript-eslint/naming-convention
                rules_to_suppress: [
                    {
                        id: 'W52',
                        reason: 'Enabling ALB access logging for Solutions Implementation is documented as a manual step'
                    }
                ]
            });
        }
        const albSGMetadataNode = this.applicationLoadBalancer.node.findChild('SecurityGroup').node
            .defaultChild;
        albSGMetadataNode.addMetadata('cfn_nag', {
            // eslint-disable-next-line @typescript-eslint/naming-convention
            rules_to_suppress: [
                {
                    id: 'W29',
                    reason: 'TODO: Security Groups found egress with port range instead of just a single port'
                },
                {
                    id: 'W9',
                    reason: 'TODO: Security Groups found with ingress cidr that is not /32'
                },
                {
                    id: 'W2',
                    reason: 'TODO: Security Groups found with cidr open to world on ingress.  This should never be true on instance.  Permissible on ELB.'
                }
            ]
        });
    }
}
exports.RSWApplicationLoadBalancer = RSWApplicationLoadBalancer;
//# sourceMappingURL=RSWApplicationLoadBalancer.js.map