openAgent

1import { domain } from "./stage"
2 
3const current = aws.getCallerIdentityOutput({})
4const partition = aws.getPartitionOutput({})
5const region = aws.getRegionOutput({})
6 
7const tableBucketName = `opencode-${$app.stage}-lake`
8const glueCatalogName = "s3tablescatalog"
9const glueCatalogArn = $interpolate`arn:${partition.partition}:glue:${region.region}:${current.accountId}:catalog`
10const glueS3TablesCatalogArn = $interpolate`${glueCatalogArn}/${glueCatalogName}`
11const glueS3TablesChildCatalogArn = $interpolate`${glueS3TablesCatalogArn}/${tableBucketName}`
12const glueS3TablesDatabaseWildcardArn = $interpolate`arn:${partition.partition}:glue:${region.region}:${current.accountId}:database/${glueCatalogName}/${tableBucketName}/*`
13const glueS3TablesTableWildcardArn = $interpolate`arn:${partition.partition}:glue:${region.region}:${current.accountId}:table/${glueCatalogName}/${tableBucketName}/*/*`
14const s3TablesBucketWildcardArn = $interpolate`arn:${partition.partition}:s3tables:${region.region}:${current.accountId}:bucket/*`
15 
16export const tableBucket = new aws.s3tables.TableBucket("LakeTableBucket", {
17  name: tableBucketName,
18  forceDestroy: $app.stage !== "production",
19})
20 
21const s3TablesCatalog = new aws.cloudcontrol.Resource(
22  "LakeS3TablesCatalog",
23  {
24    typeName: "AWS::Glue::Catalog",
25    desiredState: $jsonStringify({
26      Name: glueCatalogName,
27      Description: "Federated catalog for S3 Tables",
28      FederatedCatalog: {
29        Identifier: s3TablesBucketWildcardArn,
30        ConnectionName: "aws:s3tables",
31      },
32      CreateDatabaseDefaultPermissions: [
33        {
34          Principal: {
35            DataLakePrincipalIdentifier: "IAM_ALLOWED_PRINCIPALS",
36          },
37          Permissions: ["ALL"],
38        },
39      ],
40      CreateTableDefaultPermissions: [
41        {
42          Principal: {
43            DataLakePrincipalIdentifier: "IAM_ALLOWED_PRINCIPALS",
44          },
45          Permissions: ["ALL"],
46        },
47      ],
48      AllowFullTableExternalDataAccess: "True",
49    }),
50  },
51  { dependsOn: [tableBucket] },
52)
53 
54const athenaResultsBucket = new aws.s3.Bucket("LakeAthenaResults", {
55  bucket: `opencode-${$app.stage}-lake-athena-results`,
56  forceDestroy: $app.stage !== "production",
57})
58 
59const firehoseErrorBucket = new aws.s3.Bucket("LakeFirehoseErrors", {
60  bucket: `opencode-${$app.stage}-lake-firehose-errors`,
61  forceDestroy: $app.stage !== "production",
62})
63 
64const athenaWorkgroup = new aws.athena.Workgroup("LakeAthenaWorkgroup", {
65  name: `opencode-${$app.stage}-lake-workgroup`,
66  forceDestroy: $app.stage !== "production",
67  configuration: {
68    enforceWorkgroupConfiguration: true,
69    publishCloudwatchMetricsEnabled: true,
70    // Athena bills $5/TB scanned; kill any query that would scan more than 2 TB
71    // so a regression cannot silently burn money. Stats sync full passes scan
72    // ~250 GB as of 2026-07.
73    bytesScannedCutoffPerQuery: 2 * 1024 ** 4,
74    resultConfiguration: {
75      outputLocation: $interpolate`s3://${athenaResultsBucket.bucket}/`,
76    },
77  },
78})
79 
80const firehoseRole = new aws.iam.Role("LakeFirehoseRole", {
81  assumeRolePolicy: aws.iam.getPolicyDocumentOutput({
82    statements: [
83      {
84        effect: "Allow",
85        actions: ["sts:AssumeRole"],
86        principals: [
87          {
88            type: "Service",
89            identifiers: ["firehose.amazonaws.com"],
90          },
91        ],
92      },
93    ],
94  }).json,
95})
96 
97const firehosePolicy = new aws.iam.RolePolicy("LakeFirehosePolicy", {
98  role: firehoseRole.id,
99  policy: aws.iam.getPolicyDocumentOutput({
100    statements: [
101      {
102        effect: "Allow",
103        actions: [
104          "s3tables:ListTableBuckets",
105          "s3tables:GetTableBucket",
106          "s3tables:GetNamespace",
107          "s3tables:GetTable",
108          "s3tables:GetTableData",
109          "s3tables:GetTableMetadataLocation",
110          "s3tables:ListNamespaces",
111          "s3tables:ListTables",
112          "s3tables:PutTableData",
113          "s3tables:UpdateTableMetadataLocation",
114        ],
115        resources: ["*"],
116      },
117      {
118        effect: "Allow",
119        actions: [
120          "glue:GetCatalog",
121          "glue:GetCatalogs",
122          "glue:GetDatabase",
123          "glue:GetDatabases",
124          "glue:GetTable",
125          "glue:GetTables",
126          "glue:UpdateTable",
127        ],
128        resources: [
129          glueCatalogArn,
130          glueS3TablesCatalogArn,
131          $interpolate`${glueS3TablesCatalogArn}/*`,
132          glueS3TablesDatabaseWildcardArn,
133          glueS3TablesTableWildcardArn,
134          $interpolate`arn:${partition.partition}:glue:${region.region}:${current.accountId}:database/*`,
135          $interpolate`arn:${partition.partition}:glue:${region.region}:${current.accountId}:table/*/*`,
136          $interpolate`arn:${partition.partition}:glue:${region.region}:${current.accountId}:table/${glueCatalogName}/*`,
137        ],
138      },
139      {
140        effect: "Allow",
141        actions: [
142          "s3:AbortMultipartUpload",
143          "s3:GetBucketLocation",
144          "s3:GetObject",
145          "s3:ListBucket",
146          "s3:ListBucketMultipartUploads",
147          "s3:PutObject",
148        ],
149        resources: [firehoseErrorBucket.arn, $interpolate`${firehoseErrorBucket.arn}/*`],
150      },
151      {
152        effect: "Allow",
153        actions: ["lakeformation:GetDataAccess"],
154        resources: ["*"],
155      },
156    ],
157  }).json,
158})
159 
160const firehose = new aws.kinesis.FirehoseDeliveryStream(
161  "LakeFirehose",
162  {
163    name: `opencode-${$app.stage}-lake-ingest`,
164    destination: "iceberg",
165    icebergConfiguration: {
166      appendOnly: true,
167      bufferingInterval: 60,
168      bufferingSize: 1,
169      catalogArn: glueS3TablesChildCatalogArn,
170      processingConfiguration: {
171        enabled: true,
172        processors: [
173          {
174            type: "MetadataExtraction",
175            parameters: [
176              { parameterName: "JsonParsingEngine", parameterValue: "JQ-1.6" },
177              {
178                parameterName: "MetadataExtractionQuery",
179                parameterValue:
180                  '{destinationDatabaseName:._lake_database,destinationTableName:._lake_table,operation:(._lake_operation // "insert")}',
181              },
182            ],
183          },
184        ],
185      },
186      roleArn: firehoseRole.arn,
187      s3BackupMode: "FailedDataOnly",
188      s3Configuration: {
189        roleArn: firehoseRole.arn,
190        bucketArn: firehoseErrorBucket.arn,
191        errorOutputPrefix: "errors/!{firehose:error-output-type}/",
192      },
193    },
194  },
195  { dependsOn: [s3TablesCatalog, firehosePolicy] },
196)
197 
198export const lakeVpc = new sst.aws.Vpc("LakeVpc")
199export const lakeCluster = new sst.aws.Cluster("LakeCluster", { vpc: lakeVpc })
200export const lakeRegion = region.region
201export const lakeCatalog = $interpolate`${glueCatalogName}/${tableBucket.name}`
202export const lakeAthenaWorkgroup = athenaWorkgroup
203 
204const ingestSecret = new random.RandomPassword("LakeIngestSecret", { length: 32 })
205export const ingestSecretSsm = new aws.ssm.Parameter("LakeIngestSecretSsm", {
206  name: $interpolate`/${$app.name}/${$app.stage}/lake/ingest/secret`,
207  type: "SecureString",
208  value: ingestSecret.result,
209})
210 
211const ingestConfig = new sst.Linkable("LakeIngestConfig", {
212  properties: {
213    streamName: firehose.name,
214    secret: ingestSecret.result,
215  },
216})
217 
218const ingestService = new sst.aws.Service("LakeIngestService", {
219  cluster: lakeCluster,
220  architecture: "arm64",
221  cpu: "1 vCPU",
222  memory: "4 GB",
223  image: {
224    context: ".",
225    dockerfile: "packages/stats/server/Dockerfile",
226  },
227  link: [ingestConfig],
228  permissions: [
229    {
230      actions: ["firehose:PutRecord", "firehose:PutRecordBatch"],
231      resources: [firehose.arn],
232    },
233  ],
234  scaling: {
235    min: $app.stage === "production" ? 2 : 1,
236    max: $app.stage === "production" ? 32 : 4,
237    cpuUtilization: 60,
238    memoryUtilization: 70,
239  },
240  loadBalancer: {
241    domain: {
242      name: `lake.${domain}`,
243      dns: sst.cloudflare.dns(),
244    },
245    rules: [
246      { listen: "80/http", redirect: "443/https" },
247      { listen: "443/https", forward: "3000/http" },
248    ],
249    health: {
250      "3000/http": {
251        path: "/ready",
252        successCodes: "200-299",
253      },
254    },
255  },
256  health: {
257    command: [
258      "CMD-SHELL",
259      "bun --eval \"fetch('http://localhost:3000/health').then((r) => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))\"",
260    ],
261    interval: "30 seconds",
262    retries: 3,
263    startPeriod: "30 seconds",
264    timeout: "5 seconds",
265  },
266  dev: {
267    command: "bun run start",
268    directory: "packages/stats/server",
269    url: "http://localhost:3000",
270  },
271  wait: $app.stage === "production",
272})
273 
274export const lakeIngest = new sst.Linkable("LakeIngest", {
275  properties: {
276    url: ingestService.url,
277    secret: ingestSecret.result,
278  },
279})
280 
281export const lakeQueryPermissions = [
282  {
283    actions: ["athena:StartQueryExecution", "athena:GetQueryExecution", "athena:GetQueryResults"],
284    resources: [athenaWorkgroup.arn],
285  },
286  {
287    actions: [
288      "glue:GetCatalog",
289      "glue:GetCatalogs",
290      "glue:GetDatabase",
291      "glue:GetDatabases",
292      "glue:GetTable",
293      "glue:GetTables",
294      "glue:GetPartitions",
295    ],
296    resources: [
297      glueCatalogArn,
298      glueS3TablesCatalogArn,
299      $interpolate`${glueS3TablesCatalogArn}/*`,
300      glueS3TablesDatabaseWildcardArn,
301      glueS3TablesTableWildcardArn,
302      $interpolate`arn:${partition.partition}:glue:${region.region}:${current.accountId}:database/*`,
303      $interpolate`arn:${partition.partition}:glue:${region.region}:${current.accountId}:table/*/*`,
304      $interpolate`arn:${partition.partition}:glue:${region.region}:${current.accountId}:table/${glueCatalogName}/*`,
305    ],
306  },
307  {
308    actions: ["s3:GetBucketLocation", "s3:ListBucket"],
309    resources: [athenaResultsBucket.arn],
310  },
311  {
312    actions: ["s3:GetObject", "s3:PutObject", "s3:AbortMultipartUpload", "s3:ListBucketMultipartUploads"],
313    resources: [$interpolate`${athenaResultsBucket.arn}/*`],
314  },
315  {
316    actions: [
317      "s3tables:GetTableBucket",
318      "s3tables:GetNamespace",
319      "s3tables:GetTable",
320      "s3tables:GetTableData",
321      "s3tables:GetTableMetadataLocation",
322      "s3tables:ListNamespaces",
323      "s3tables:ListTables",
324    ],
325    resources: ["*"],
326  },
327  {
328    actions: ["lakeformation:GetDataAccess"],
329    resources: ["*"],
330  },
331]
332