From 90b8c3cf8070352c5249ec3de1a861e03540ecc1 Mon Sep 17 00:00:00 2001
From: Ryan Kilpadi <47367209+rkilpadi@users.noreply.github.com>
Date: Wed, 16 Aug 2023 11:21:48 -0400
Subject: [PATCH] Add option for private PCUI deployment (#251)

* Move ApiGateway from HTTP to REST

* Configure routing for new stage 'pcui'

* Add VpcEndpointId parameter to conditionally make PCUI API private
---
 api/PclusterApiHandler.py                     |   2 +-
 app.py                                        |   1 +
 frontend/next.config.js                       |   3 +-
 frontend/public/favicon.ico                   | Bin 15406 -> 0 bytes
 frontend/src/components/ErrorBoundary.tsx     |   2 +-
 frontend/src/components/NoMatch.tsx           |   2 +-
 frontend/src/components/SideBar.tsx           |   2 +-
 frontend/src/components/TopBar.tsx            |   6 +-
 frontend/src/http/executeRequest.tsx          |   2 +-
 .../src/old-pages/Configure/Queues/Queues.tsx |   4 +-
 frontend/src/pages/_app.tsx                   |   7 +-
 frontend/src/pages/_document.tsx              |   2 +-
 frontend/src/pages/index.tsx                  |   2 +-
 infrastructure/parallelcluster-ui.yaml        | 168 ++++++++++++++----
 14 files changed, 154 insertions(+), 49 deletions(-)
 delete mode 100644 frontend/public/favicon.ico

diff --git a/api/PclusterApiHandler.py b/api/PclusterApiHandler.py
index cb885d9b..737c81e9 100644
--- a/api/PclusterApiHandler.py
+++ b/api/PclusterApiHandler.py
@@ -657,7 +657,7 @@ def login():
     id_token = code_resp.json().get("id_token")
     refresh_token = code_resp.json().get("refresh_token", None)
 
-    resp = redirect("/index.html", code=302)
+    resp = redirect("/pcui/index.html", code=302)
     resp.set_cookie("accessToken", access_token, httponly=True, secure=True, samesite="Lax")
     resp.set_cookie("idToken", id_token, httponly=True, secure=True, samesite="Lax")
     if refresh_token is not None:
diff --git a/app.py b/app.py
index 0ce904b1..17e38e46 100644
--- a/app.py
+++ b/app.py
@@ -69,6 +69,7 @@ def default(self, obj):
 
 def run():
     app = utils.build_flask_app(__name__)
+    app.config["APPLICATION_ROOT"] = '/pcui'
     app.json_encoder = PClusterJSONEncoder
     app.url_map.converters["regex"] = RegexConverter
     CSRF(app, CognitoFingerprintGenerator(CLIENT_ID, CLIENT_SECRET, USER_POOL_ID))
diff --git a/frontend/next.config.js b/frontend/next.config.js
index 4482fd6a..e796ecad 100644
--- a/frontend/next.config.js
+++ b/frontend/next.config.js
@@ -11,6 +11,7 @@
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   reactStrictMode: true,
+  basePath: '/pcui',
   experimental: {
     images: {
       unoptimized: true,
@@ -47,4 +48,4 @@ const withTM = require("next-transpile-modules")([
   "@cloudscape-design/design-tokens"
 ]);
 
-module.exports = withTM(nextConfig);  
\ No newline at end of file
+module.exports = withTM(nextConfig);
diff --git a/frontend/public/favicon.ico b/frontend/public/favicon.ico
deleted file mode 100644
index 8435131c2201cb9fced41d7d9cfe8c587694ac9c..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 15406
zcmeHN32>Fw75=j)CO`;T2}@WK0wiRS?1-|2&9DZ-9zcjnSkpitDj4=HKnMh}R&?6h
zYHh3Csa2=bnWAI09i^7(YVBgJTg6(dqB;G(^YTC5p7$UL$@FFB&Y$=HcRBamv)%I@
z!w4{fjOb_s&lKa%V8h5a3?n7Q@;kk+VVuRg?CiGhX@+q=&M?x^2SYHz@*WS@fA@<R
z-Mob~y(_&MUX)(DUXsAmANx#i;^xPscf&6vX~S0~;^6NwzSXBWI6nNyUnF+x52Rn+
zk0fF9H=M_x`CQ_*d{_Ffdl>B@iQ4;XYoA`beklX1PD%2e4@hwH`;xff5$iXT_whB~
zlE{4*E${F9Ok(TKNxyARNw3|%(m6wq{Zj_s-Xi_0ACkWH&!C_E9+IoiI?c)b4yimK
z#u@v*Tr240zwP?>25(JT_>4ICM_ntv=G)R|=W{mewMz2ZFG;}ZPwo20ZvDRYPg!|b
zd7Xf9#+lD_T=d;P(=mw~zlP_7`rURd{!gB8&g8WZV4jC1X8Y52^K%aYIQszb#&Ilv
z$J9S9eRiCer1f9c?@2fZSN%M`!x^S7s+WX~kLr1O?CVBn0$V<oz?T1l&da{9?`F=c
zp~LGjuC0RCZ)s;z&~8DaeRBJEJ@)2bvuDU)4?CyWZRcRizj&opKPX|1fA2D0XHO}&
z+Ed!pjIvem6+iB>^|PkVmyo7+tm~z$JcRYn!QOw~X7f8Yrf|7F{N?baJCzqoM<>b@
z`A?r1x$jkNX$$Lg|McxSlV)1@;O+YGYhg$Js{W4gMa=e}XsqFB4}+>s%E-Cv+FG@w
zmv55D{TC(h)JHz8AK3Dd3|@0W#!OozLo4^m;8l$>bop+{ytPu&7HyY^Lw~{<+s6*{
z!SP>sLJ~JUDv^kB7}uD-#;5fW8>Fl{qW+eAv&Jak2j^idHD>x^@cDTw4U7X*7jBod
zh1;NSe?uJcqKv(HvZPgP(Kcd!jpR<4?iK$TlVy~xbc%z_z3>^e_f^T9u@rH|bCCCU
zW%R5yGT@Fgh(kWnJ(EtxXBwL_K1HKUL>xejNnP+D11YyPf{%!iJoMqW$bG+&tf>`B
zE91xZ;)<Y?AIPXVYwh&Y)f(iXg}0t{mGO4^ybY3f(*y}W^jf?0GWH>#cs{PyHQx<_
z-1OW2l*c{+_kAjZS2xM<CHJVjjh<B{jDyWNTs>)*GG{E)^K$jwd>7pOfy$Zr+wsZx
zc*u%_lDhaV^!tyVX9D78$_&rM<@w^w8Glljtn%#cd?DwQ|Mc>W);3~6Ep-2N>2vS%
zk}-2NzBgLdHs`?neee3I?vHVH)Sj0m<oMeXguR3we+&1UN1(ea+U1e%6?5fIyj685
zYR?7Cbpd)+r}E5Lp7#NFv379NdwL!t=dD+MWPsoFLELxf(KkGvkCo3@pSF@Z#CJS5
z+8f$J&JlX_&30v-y1;V^YQBW$hpx}W<elTwc750)@`CmzbNW(k`6V|gf35U7j=$F5
zSpP=YD%#PI<L_8_0o^gzqfMhdF@JabvsLX6?_;6I-n<U$+t?l4=~NcDf9M5U=kMQU
zeVl*J<T;XEI!Cff=V{9yHy-x?LMQUyW_`#K<v94n`&SxdIzaEw_We3u4*c``dD;as
z;5ISv|M7u&5~OI2m1zDvNf*f5wfblO_%8E(e*5d!haM{fh~t?L2w=|Nskz51y32ke
z5Byg1DH$_w!=2N<F^@o8rMuATijJ82XQi+(Uq;QoT}I5`Y;DYs6%~xtJG5gC%hf#B
z>mB)<UosAO8***LjM|#s2}@@S@A*A}{_w+pwv&_K6aSJN+^3X&>IiZ<Y%cRA*U{IS
z{P#pZvD}e!t0l8+g+wbB+I{S`H}n&mNCs|PP+TGjHQ(%3@<jRzii;!(I7STefo6-V
zeM0iaPqfN^$cgtf*PF2U@eZM%cWcd?A)gr5_=cq+@5DSWbC}-h9COgwrE?{}c%167
zKEY?|bl&(0*p~(CXO4U9&84UvxK{dGg}jKZ`yuk8JCW~Oj`im$4Oze?n3Ef{rWv{2
z^QbkrWXY#^(669VA8K6%v4^NVufX0v16esMQM+H38xH<K>lJ7lJBI#N%}ovi#*jO)
zOmU0&+9xG?$IlhJ=i01s7=xU9&g9uLbj5xNKm5AeJ<y)8CL|qs|MUel==+-Hw204y
zIpiTbg8mTXScfg!WzE|$*B$`dX6rjh6Z<i*$GknygS=GRXFZ2j&G*D@`JQA=TPPW`
zR)g=)Y9Ed(EG&?Lz!?%ZJ!WmJD=C0XU9J8GB1U121^G(+MswO$dYtVUYccvXyrA?m
zE+F1zVh<t5-oiPZhRl_#f3=*Eg%89OM#C2~Pwv>ri{AIX;PyOi`RMq6=+S>5K3N4k
z;8?q~n`3!4%qgc;Y}NcUF(2mH23EB|7pKSo)Ukvhmu;)-+&6s}b<9;`?q7M)h5?yt
zwfEG#J#>|Lk?nfzjbkn}0=Nq?KH?w5O{nk5z?`YO?T)uOW1b)7hp~~bcy)i^8l&I?
z!;W~ybzIRy9D%ht%&`|0+$ckU7hCx5EO)NPo9{Re?G){;VlXy)GyAxECZncE_kGlN
zoSuB^2V9miQ&3zislcOb@o#r)I=-jRVO>-1q%xne1=<S6<E+baoY&KDuGzccCDol&
zV7m0P*}(6KA*+AzfrqqV96ts&i@w3rx{lu{!-=S?3I$%}_|4sK-mB;vsQ1L-!lBEQ
zdCGA1)CEEeRdGfK8|-erkfyg`3+muEcc>k3*U!~^+7gWmh);OIGul_48Fh6;MXl<v
z8T$s|TRiaXT;N}+i|ZlF7p=C{-Q1Kx%6`_g3iZ)G*^oARS;NR$MoWz%>lCjv){zi<
z<QWsgW?cZ|_hHK#ESR3dzS+-W(<*_REfLxW-X$qhmijlw`<GF#`H99<aiBd1dP~fc
zHrU-h-M<H3Rr?(&EGkr6J_@$bY?(8bOHqEVu&$B5C~d(O#h{Zme%+&<l0Mc=4616@
z*xsyrpl&3s|BCuc;$y_h>8FWrs;_gXiEvM|t$l0N*l+CkNm}2*c*Jbfr3_%^tSt>X
zc}e|C1Y#NTuHCtDF2qo8*#A55=Sk4GA3l2>Fw7;Yr<w4>Lo4^H%y<(Ix?iu2e#Ee(
z+w4bwN$i!lEp0l_-faA4_VenAy-+uZFB9h{225Pr606w9SzgU&r>8FHhfeoLjV$Bn
z;fwFFZ+Mr0_)B%(ZXVk+?aKe1>8B1d#>}2FAGF_XM?ZCPG~!CeGQRVwGxi1gYaZ7-
z9q$>eTL?g{Y!+xAaL4^lSSMp&#*d7_x(ofR`^!VUQO+dfWl)<z-u4{&d562CaZ}Xp
zSJc*1wtEu&j&h*#-(%#*S*J)p@2af(p>L=CHydM=?j`@O=)Wu@%QqnRQ6hP$m#}U5
zB_*gK+$O=eBRig3_xWwfr7&0Es;QrIh<myZ?at@nr_Ik3zYO?gz%K(mSO!oZ<p1+?
I;A%PWKRBxn)c^nh

diff --git a/frontend/src/components/ErrorBoundary.tsx b/frontend/src/components/ErrorBoundary.tsx
index b4459664..bcc400e7 100644
--- a/frontend/src/components/ErrorBoundary.tsx
+++ b/frontend/src/components/ErrorBoundary.tsx
@@ -42,7 +42,7 @@ export class ErrorBoundary extends Component<ErrorBoundaryProps, State> {
   }
 
   private redirectToHomepage = () => {
-    window.location.href = '/'
+    window.location.href = '/pcui'
   }
 
   public static getDerivedStateFromError(_: Error): State {
diff --git a/frontend/src/components/NoMatch.tsx b/frontend/src/components/NoMatch.tsx
index 598743c7..e75e4c34 100644
--- a/frontend/src/components/NoMatch.tsx
+++ b/frontend/src/components/NoMatch.tsx
@@ -38,7 +38,7 @@ export function NoMatch() {
             <p>{t('noMatch.links')}</p>
             <ul>
               <li>
-                <Link href="/">{t('noMatch.home')}</Link>
+                <Link href="/pcui">{t('noMatch.home')}</Link>
               </li>
             </ul>
           </TextContent>
diff --git a/frontend/src/components/SideBar.tsx b/frontend/src/components/SideBar.tsx
index 1c7376b9..b4a6ae60 100644
--- a/frontend/src/components/SideBar.tsx
+++ b/frontend/src/components/SideBar.tsx
@@ -41,7 +41,7 @@ export default function SideBar() {
         {
           type: 'link',
           text: t('global.menu.viewLicense'),
-          href: '/license.txt',
+          href: '/pcui/license.txt',
           external: true,
         },
       ]
diff --git a/frontend/src/components/TopBar.tsx b/frontend/src/components/TopBar.tsx
index 93e991f4..144ab011 100644
--- a/frontend/src/components/TopBar.tsx
+++ b/frontend/src/components/TopBar.tsx
@@ -135,7 +135,7 @@ export default function Topbar() {
       {
         id: 'signout',
         text: t('global.topBar.signOut'),
-        href: '/logout',
+        href: '/pcui/logout',
       },
     ],
     [t],
@@ -146,9 +146,9 @@ export default function Topbar() {
       <TopNavigation
         identity={{
           title: t('global.projectDisplayName'),
-          href: '/',
+          href: '/pcui',
           logo: {
-            src: '/img/pcluster.svg',
+            src: '/pcui/img/pcluster.svg',
             alt: t('global.topBar.logoAltText'),
           },
         }}
diff --git a/frontend/src/http/executeRequest.tsx b/frontend/src/http/executeRequest.tsx
index 0dfca209..094cf641 100644
--- a/frontend/src/http/executeRequest.tsx
+++ b/frontend/src/http/executeRequest.tsx
@@ -10,7 +10,7 @@ export const axiosInstance = axios.create({
 
 function getHost() {
   if (process.env.NODE_ENV !== 'production') return 'http://localhost:5001/'
-  return '/'
+  return '/pcui'
 }
 
 export type HTTPMethod = 'get' | 'put' | 'post' | 'patch' | 'delete'
diff --git a/frontend/src/old-pages/Configure/Queues/Queues.tsx b/frontend/src/old-pages/Configure/Queues/Queues.tsx
index 311067a8..2cc7261e 100644
--- a/frontend/src/old-pages/Configure/Queues/Queues.tsx
+++ b/frontend/src/old-pages/Configure/Queues/Queues.tsx
@@ -394,8 +394,8 @@ function Queue({index}: any) {
   ])
 
   const capacityTypes: [string, string, string][] = [
-    ['ONDEMAND', 'On-Demand', '/img/od.svg'],
-    ['SPOT', 'Spot', '/img/spot.svg'],
+    ['ONDEMAND', 'On-Demand', '/pcui/img/od.svg'],
+    ['SPOT', 'Spot', '/pcui/img/spot.svg'],
   ]
   const capacityTypePath = [...queuesPath, index, 'CapacityType']
   const capacityType: string = useState(capacityTypePath) || 'ONDEMAND'
diff --git a/frontend/src/pages/_app.tsx b/frontend/src/pages/_app.tsx
index 9a100cb4..efcd0adc 100644
--- a/frontend/src/pages/_app.tsx
+++ b/frontend/src/pages/_app.tsx
@@ -48,7 +48,7 @@ function App({Component, pageProps}: AppProps) {
 
   const onAceLoad = useCallback(() => {
     window.editor = window.ace.edit('editor')
-    window.ace.config.set('basePath', '/third-party/ace-1.4.13/')
+    window.ace.config.set('basePath', '/pcui/third-party/ace-1.4.13/')
     window.ace.config.set('loadWorkerFromBlob', false)
     window.ace.config.set('showFoldWidgets', false)
     window.ace.config.set('showPrintMargin', false)
@@ -75,7 +75,10 @@ function App({Component, pageProps}: AppProps) {
         </I18nextProvider>
       </QueryClientProvider>
       <div id="editor"></div>
-      <Script src="/third-party/ace-1.4.13/ace.min.js" onLoad={onAceLoad} />
+      <Script
+        src="/pcui/third-party/ace-1.4.13/ace.min.js"
+        onLoad={onAceLoad}
+      />
     </>
   )
 }
diff --git a/frontend/src/pages/_document.tsx b/frontend/src/pages/_document.tsx
index 555192df..ee8e85e2 100644
--- a/frontend/src/pages/_document.tsx
+++ b/frontend/src/pages/_document.tsx
@@ -14,7 +14,7 @@ export default function Document() {
     <Html lang="en">
       <Head>
         <meta charSet="utf-8" />
-        <link rel="icon" href="favicon.ico" />
+        <link rel="icon" href="/pcui/img/pcluster.svg" />
         <meta name="theme-color" content="#000000" />
         <meta name="description" content="AWS ParallelCluster UI" />
       </Head>
diff --git a/frontend/src/pages/index.tsx b/frontend/src/pages/index.tsx
index 16507809..f0d2152c 100644
--- a/frontend/src/pages/index.tsx
+++ b/frontend/src/pages/index.tsx
@@ -26,7 +26,7 @@ import {useLoadingState} from '../components/useLoadingState'
 
 export default function App() {
   const {loading, content} = useLoadingState(
-    <BrowserRouter>
+    <BrowserRouter basename='/pcui'>
       <Routes>
         <Route
           path="index.html"
diff --git a/infrastructure/parallelcluster-ui.yaml b/infrastructure/parallelcluster-ui.yaml
index 7fff2314..be4ce812 100644
--- a/infrastructure/parallelcluster-ui.yaml
+++ b/infrastructure/parallelcluster-ui.yaml
@@ -7,6 +7,18 @@ Parameters:
     Description: When specified, the URI of the Docker image for the Lambda of the ParallelCluster UI container
     Type: String
     Default: public.ecr.aws/pcm/parallelcluster-ui:2023.10.0
+  VpcEndpointId:
+    Description: Enter a VPC endpoint to enable private PCUI implementation. When enabled, the API will only accept requests from within the given VPC.
+    Type: String
+    Default: ''
+  LambdaSubnetIds:
+    Description: Comma separated list of subnet IDs to be associated with the PCUI Lambda function. These subnets should be private and associated with your VPC endpoint.
+    Type: CommaDelimitedList
+    Default: ''
+  LambdaSecurityGroupIds:
+    Description: Comma separated list of security groups to be associated with the PCUI Lambda function.
+    Type: CommaDelimitedList
+    Default: ''
   UserPoolId:
     Description: UserPoolId of a previously deployed PCUI Cognito User Pool. Leave blank to create a new one.
     Type: String
@@ -47,6 +59,12 @@ Metadata:
           default: ParallelCluster UI
         Parameters:
           - PublicEcrImageUri
+      - Label:
+          default: (Optional) Private PCUI
+        Parameters:
+          - VpcEndpointId
+          - LambdaSubnetIds
+          - LambdaSecurityGroupIds
       - Label:
           default: (Optional) External PCUI Cognito
         Parameters:
@@ -82,6 +100,7 @@ Conditions:
     Fn::And:
       - !Not [!Equals [!Ref ImageBuilderVpcId, ""]]
       - !Not [!Equals [!Ref ImageBuilderSubnetId, ""]]
+  IsPrivate: !Not [!Equals [!Ref VpcEndpointId, ""]]
   HasDefaultInfrastructure: !Equals [!Ref InfrastructureBucket, '']
   UseExistingCognito:
     !And
@@ -133,6 +152,7 @@ Resources:
         ApiDefinitionS3Uri: !Sub s3://${AWS::Region}-aws-parallelcluster/parallelcluster/${Version}/api/ParallelCluster.openapi.yaml
         CreateApiUserRole: False
         EnableIamAdminAccess: True
+        VpcEndpointId: !If [ IsPrivate, !Ref VpcEndpointId, !Ref AWS::NoValue ]
         ImageBuilderSubnetId: !If
           - UseNonDockerizedPCAPI
           - !Ref AWS::NoValue
@@ -162,12 +182,18 @@ Resources:
           Value: !FindInMap [ ParallelClusterUI, Constants, Version ]
       TracingConfig:
         Mode: Active
+      VpcConfig:
+        Fn::If:
+          - IsPrivate
+          - SubnetIds: !Ref LambdaSubnetIds
+            SecurityGroupIds: !Ref LambdaSecurityGroupIds
+          - !Ref AWS::NoValue
       Environment:
         Variables:
           API_BASE_URL: !GetAtt [ ParallelClusterApi, Outputs.ParallelClusterApiInvokeUrl ]
           API_VERSION: !Ref Version
           SITE_URL: !Sub
-           - https://${Api}.execute-api.${AWS::Region}.${AWS::URLSuffix}
+           - https://${Api}.execute-api.${AWS::Region}.${AWS::URLSuffix}/pcui
            - Api: !Ref ApiGateway
           AUTH_PATH: !If [ UseExistingCognito, !Ref UserPoolAuthDomain, !GetAtt [ Cognito, Outputs.UserPoolAuthDomain ]]
           SECRET_ID: !GetAtt UserPoolClientSecret.SecretName
@@ -185,52 +211,121 @@ Resources:
               - [!Select [2, !Split ['/', !Ref EcrImage]], !Select [3, !Split ['/', !Ref EcrImage]]]
 
   ApiGateway:
-    Type: AWS::ApiGatewayV2::Api
+    Type: AWS::ApiGateway::RestApi
     Properties:
       Name: ParallelClusterUI
       Description: ParallelClusterUI Lambda Proxy
-      ProtocolType: HTTP
+      Policy:
+        Fn::If:
+          - IsPrivate
+          - Version: "2012-10-17"
+            Statement:
+              - Effect: "Deny"
+                Principal: "*"
+                Action: "execute-api:Invoke"
+                Resource: "execute-api:/*"
+                Condition:
+                  StringNotEquals:
+                    aws:sourceVpce: !Ref VpcEndpointId
+              - Effect: "Allow"
+                Principal: "*"
+                Action: "execute-api:Invoke"
+                Resource: "execute-api:/*"
+          - Version: "2012-10-17"
+            Statement:
+            - Effect: "Allow"
+              Principal: "*"
+              Action: "execute-api:Invoke"
+              Resource: "execute-api:/*"
+      EndpointConfiguration:
+        Types:
+          - !If [ IsPrivate, PRIVATE, REGIONAL ]
+        VpcEndpointIds:
+          - !If [ IsPrivate, !Ref VpcEndpointId, !Ref AWS::NoValue ]
       Tags:
-        'parallelcluster:ui:version': !FindInMap [ParallelClusterUI, Constants, Version]
-
-  ApiGatewayRoute:
-    Type: AWS::ApiGatewayV2::Route
-    Properties:
-      ApiId: !Ref ApiGateway
-      RouteKey: $default
-      Target: !Sub
-        - 'integrations/${IntegrationId}'
-        - { IntegrationId: !Ref ApiGatewayIntegration }
-
-  ApiGatewayIntegration:
-    Type: AWS::ApiGatewayV2::Integration
+        - Key: 'parallelcluster:ui:version'
+          Value: !FindInMap [ParallelClusterUI, Constants, Version]
+
+  ApiGatewayProxyResource:
+    Type: AWS::ApiGateway::Resource
+    Properties:
+      RestApiId: !Ref ApiGateway
+      ParentId: !GetAtt ApiGateway.RootResourceId
+      PathPart: '{proxy+}'
+
+  ApiGatewayMethod:
+    Type: AWS::ApiGateway::Method
+    Properties:
+      RestApiId: !Ref ApiGateway
+      ResourceId: !Ref ApiGatewayProxyResource
+      HttpMethod: ANY
+      AuthorizationType: NONE
+      Integration:
+        Type: AWS_PROXY
+        IntegrationHttpMethod: POST
+        Uri: !Sub
+          - arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:ParallelClusterUIFunction-${StackIdSuffix}/invocations
+          - { StackIdSuffix: !Select [2, !Split ['/', !Ref 'AWS::StackId']] }
+
+  ApiGatewayRootMethod:
+    Type: AWS::ApiGateway::Method
+    Properties:
+      RestApiId: !Ref ApiGateway
+      ResourceId: !GetAtt ApiGateway.RootResourceId
+      HttpMethod: ANY
+      AuthorizationType: NONE
+      Integration:
+        Type: AWS_PROXY
+        IntegrationHttpMethod: POST
+        Uri: !Sub
+          - arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:ParallelClusterUIFunction-${StackIdSuffix}/invocations
+          - { StackIdSuffix: !Select [2, !Split ['/', !Ref 'AWS::StackId']] }
+
+  ApiGatewayLogRole:
+    Type: AWS::IAM::Role
     Properties:
-      ApiId: !Ref ApiGateway
-      Description: 'ANY integration'
-      IntegrationType: AWS_PROXY
-      IntegrationUri: !Sub
-        - arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:ParallelClusterUIFunction-${StackIdSuffix}/invocations
-        - { StackIdSuffix: !Select [2, !Split ['/', !Ref 'AWS::StackId']] }
-      PayloadFormatVersion: 2.0
-      TimeoutInMillis: 30000
+      AssumeRolePolicyDocument:
+        Version: 2012-10-17
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: apigateway.amazonaws.com
+            Action:
+              - 'sts:AssumeRole'
+      ManagedPolicyArns:
+        - 'arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs'
 
   ApiGatewayAccessLog:
     Type: AWS::Logs::LogGroup
     Properties:
       RetentionInDays: 90
 
+  ApiGatewayAccount:
+    Type: AWS::ApiGateway::Account
+    Properties:
+      CloudWatchRoleArn: !GetAtt ApiGatewayLogRole.Arn
+
+  ApiGatewayDeployment:
+    Type: AWS::ApiGateway::Deployment
+    DependsOn: ApiGatewayMethod
+    Properties:
+      RestApiId: !Ref ApiGateway
+
   ApiGatewayStage:
-    Type: AWS::ApiGatewayV2::Stage
+    Type: AWS::ApiGateway::Stage
+    DependsOn: ApiGatewayAccount
     Properties: 
-      AccessLogSettings: 
+      AccessLogSetting:
         DestinationArn: !GetAtt ApiGatewayAccessLog.Arn
         Format: '{ "requestId":"$context.requestId", "ip": "$context.identity.sourceIp", "requestTime":"$context.requestTime", "httpMethod":"$context.httpMethod","path":"$context.path", "status":"$context.status","protocol":"$context.protocol", "responseLength":"$context.responseLength" }'
-      ApiId: !Ref ApiGateway
-      StageName: $default
-      AutoDeploy: True
-      DefaultRouteSettings:
-        ThrottlingBurstLimit: 50 
-        ThrottlingRateLimit: 100
+      RestApiId: !Ref ApiGateway
+      DeploymentId: !Ref ApiGatewayDeployment
+      StageName: pcui
+      MethodSettings:
+        - ResourcePath: '/*'
+          HttpMethod: '*'
+          ThrottlingBurstLimit: 50
+          ThrottlingRateLimit: 100
 
   CognitoAppClient:
     Type: AWS::Cognito::UserPoolClient
@@ -246,7 +341,7 @@ Resources:
         - ALLOW_REFRESH_TOKEN_AUTH
       CallbackURLs:
         - !Sub
-          - https://${Api}.execute-api.${AWS::Region}.${AWS::URLSuffix}/login
+          - https://${Api}.execute-api.${AWS::Region}.${AWS::URLSuffix}/pcui/login
           - Api: !Ref ApiGateway
       SupportedIdentityProviders:
         - COGNITO
@@ -707,6 +802,11 @@ Resources:
             - ec2:DescribeInstanceTypes
             - ec2:DescribeSubnets
             - ec2:DescribeKeyPairs
+            - ec2:DescribeNetworkInterfaces
+            - ec2:CreateNetworkInterface
+            - ec2:DeleteNetworkInterface
+            - ec2:DescribeInstances
+            - ec2:AttachNetworkInterface
             Resource:
               - '*'
             Effect: Allow
@@ -822,7 +922,7 @@ Outputs:
     Export:
       Name: !Sub ${AWS::StackName}-ParallelClusterUISite
     Value: !Sub
-      - https://${Api}.execute-api.${AWS::Region}.${AWS::URLSuffix}
+      - https://${Api}.execute-api.${AWS::Region}.${AWS::URLSuffix}/pcui
       - Api: !Ref ApiGateway
   AppClientId:
     Description: The id of the Cognito app client