v1.7.2 — External Datasources + Dynamic VPC CIDR

Added 7 external datasource types manageable in a Grafana-style interface. Includes SSRF defense and SQL Injection prevention security layers, dynamic VPC CIDR configuration, and a dedicated datasource diagnostics agent.

Key Changes

7 External Datasources · SSRF Defense · SQL Injection Prevention · Dynamic VPC CIDR · Datasource Diagnostics Agent

External Datasource Management

Connect and query external observability tools directly from AWSops, similar to Grafana's datasource management.

7 Supported Datasource Types

Type	Query Language	Primary Use
Prometheus	PromQL	Metric collection/query
Loki	LogQL	Log aggregation/search
Tempo	TraceQL	Distributed tracing
ClickHouse	SQL	Analytics data warehouse
Jaeger	Trace API	Distributed tracing
Dynatrace	API	APM / full-stack observability
Datadog	API	Monitoring / APM

Feature Details

Feature	Description
CRUD	Create/edit/delete datasources (Admin only)
Connection Test	One-click connection test + response time (ms) measurement
Query Execution	Execute queries using type-specific query languages
4 Auth Methods	None, Basic Auth, Bearer Token, Custom Header
Credential Masking	Passwords/tokens masked as *** in API responses
i18n	Korean + English support

config.json Datasource Configuration

Datasources are managed via a datasources array in data/config.json:

{
  "costEnabled": true,
  "agentRuntimeArn": "arn:aws:bedrock-agentcore:...",
  "datasources": [
    {
      "id": "prom-1",
      "name": "Production Prometheus",
      "type": "prometheus",
      "url": "https://prometheus.example.com:9090",
      "authType": "bearer",
      "authConfig": { "token": "***" },
      "isDefault": true
    }
  ]
}

Datasource Management Principle

Same pattern as the existing accounts[] array — modify only data/config.json to add/remove datasources without code changes. Only Admin-privileged users can perform CRUD operations.

Security: SSRF Defense

A validation layer prevents SSRF (Server-Side Request Forgery) attacks before sending requests to external URLs.

// src/lib/datasource-client.ts (simplified)
function validateUrl(url: string): void {
  const parsed = new URL(url);
  const hostname = parsed.hostname;

  // Block private IP ranges
  const privatePatterns = [
    /^10\./, /^172\.(1[6-9]|2\d|3[01])\./,
    /^192\.168\./, /^127\./, /^169\.254\./, /^0\./,
  ];

  // Block cloud metadata endpoint
  if (hostname === '169.254.169.254') {
    throw new Error('SSRF blocked: cloud metadata endpoint');
  }
}

Security: ClickHouse SQL Injection Prevention

ClickHouse queries use parameterized queries instead of string interpolation:

// Safe: parameterized query
const response = await fetch(`${url}/?param_service=${encodeURIComponent(service)}`, {
  method: 'POST',
  body: `SELECT * FROM logs WHERE service = {service:String}`,
});

Dynamic VPC CIDR

VPC CIDR can now be set via CDK context parameters.

Item	Before (v1.7.1)	After (v1.7.2)
VPC CIDR	Hardcoded	newVpcCidr context parameter
Default	—	10.10.0.0/16
TGW Route CIDR	tgwRouteCidr (single)	tgwRouteCidrs (multiple, comma-separated)

cdk deploy -c newVpcCidr=10.20.0.0/16 \
  -c tgwRouteCidrs=10.10.0.0/16,10.30.0.0/16,172.16.0.0/12

Datasource Diagnostics Agent

A dedicated agent for systematically diagnosing external datasource connection issues. A new datasource route (priority 11) is added to AI routing.

Diagnostic areas: Network (host reachability, firewall/SG), Authentication (credential validity, token expiry), SSL/TLS (certificate chain), DNS (resolution, propagation).

Version Comparison

Item	v1.7.1	v1.7.2	Change
Pages	36	37	+datasources
API Routes	13	14	+datasources API
AI Routes	10	11	+datasource diagnostics
Datasource Types	0	7	New feature
Auth Methods	—	4	None/Basic/Bearer/Custom