@aligent/cdk-header-change-detection 1.6.1 → 1.7.1

package/CHANGELOG.md

@@ -0,0 +1,13 @@
+# @aligent/cdk-header-change-detection
+
+## 1.7.1
+
+### Patch Changes
+
+- [#1523](https://github.com/aligent/cdk-constructs/pull/1523) [`2550ceb`](https://github.com/aligent/cdk-constructs/commit/2550cebd411cf2cfd5b92deba17e18a5a3d3d012) Thanks [@TheOrangePuff](https://github.com/TheOrangePuff)! - Fixes changeset publishing to work correctly by switching from dist-based builds to in-place compilation within packages
+
+## 1.7.0
+
+### Minor Changes
+
+- [#1512](https://github.com/aligent/cdk-constructs/pull/1512) [`a9a6231`](https://github.com/aligent/cdk-constructs/commit/a9a62319e4528ac2d23f3af96e96cb2427f242f8) Thanks [@TheOrangePuff](https://github.com/TheOrangePuff)! - Adds changeset package to handle release management

package/README.md

@@ -0,0 +1,65 @@
+# Aligent Header Change Detection Service
+
+## Overview
+
+Creates a Lambda function that periodically scans security headers and sends the results to SNS.
+
+### Diagram
+
+![diagram](docs/diagram.jpg)
+
+This service aims to comply with PCI DSS to cover the requirements outlined by section 11.6.1.
+
+**11.6.1**: A change- and tamper-detection mechanism is deployed as follows:
+
+> - To alert personnel to unauthorized modification (including indicators of compromise, changes, additions, and deletions) to the security-impacting HTTP headers and the script contents of payment pages as received by the consumer browser.
+> - The mechanism is configured to evaluate the received HTTP headers and payment pages.
+> - The mechanism functions are performed as follows:
+>   - At least weekly
+>     OR
+>   - Periodically (at the frequency defined in the entity’s targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1)
+
+## Default config
+
+By default, the following headers are monitored:
+
+- Content-Security-Policy
+- Content-Security-Policy-Report-Only
+- Reporting-Endpoints
+- Strict-Transport-Security
+- X-Frame-Options
+- X-Content-Type-Options
+- Cross-Origin-Opener-Policy
+- Cross-Origin-Embedder-Policy
+- Cross-Origin-Resource-Policy
+- Referrer-Policy
+- Permission-Policy
+- Cache-Control
+
+## Usage
+
+To include this in your CDK stack, add the following:
+
+```typescript
+// Import required packages
+import { SnsTopic } from "aws-cdk-lib/aws-events-targets";
+import { Topic } from "aws-cdk-lib/aws-sns";
+import { HeaderChangeDetection } from "@aligent/cdk-header-change-detection";
+
+// Create a new SNS topic
+const topic = new Topic(this, "Topic");
+const snsTopic = new SnsTopic(topic);
+
+// Pass the required props
+new HeaderChangeDetection(this, "HeaderChangeDetection", { snsTopic });
+```
+
+## Local development
+
+[NPM link](https://docs.npmjs.com/cli/v7/commands/npm-link) can be used to develop the module locally.
+
+1. Pull this repository locally
+2. `cd` into this repository
+3. run `npm link`
+4. `cd` into the downstream repo (target project, etc) and run `npm link '@aligent/cdk-header-change-detection'`
+   The downstream repository should now include a symlink to this module. Allowing local changes to be tested before pushing. You may want to update the version notation of the package in the downstream repository's `package.json`.

package/index.js

@@ -3,4 +3,4 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.HeaderChangeDetection = void 0;
 const header_change_detection_1 = require("./lib/header-change-detection");
 Object.defineProperty(exports, "HeaderChangeDetection", { enumerable: true, get: function () { return header_change_detection_1.HeaderChangeDetection; } });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9wYWNrYWdlcy9oZWFkZXItY2hhbmdlLWRldGVjdGlvbi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwyRUFHdUM7QUFFOUIsc0dBSlAsK0NBQXFCLE9BSU8iLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQge1xuICBIZWFkZXJDaGFuZ2VEZXRlY3Rpb24sXG4gIEhlYWRlckNoYW5nZURldGVjdGlvblByb3BzLFxufSBmcm9tIFwiLi9saWIvaGVhZGVyLWNoYW5nZS1kZXRlY3Rpb25cIjtcblxuZXhwb3J0IHsgSGVhZGVyQ2hhbmdlRGV0ZWN0aW9uLCBIZWFkZXJDaGFuZ2VEZXRlY3Rpb25Qcm9wcyB9O1xuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJpbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwyRUFHdUM7QUFFOUIsc0dBSlAsK0NBQXFCLE9BSU8iLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQge1xuICBIZWFkZXJDaGFuZ2VEZXRlY3Rpb24sXG4gIEhlYWRlckNoYW5nZURldGVjdGlvblByb3BzLFxufSBmcm9tIFwiLi9saWIvaGVhZGVyLWNoYW5nZS1kZXRlY3Rpb25cIjtcblxuZXhwb3J0IHsgSGVhZGVyQ2hhbmdlRGV0ZWN0aW9uLCBIZWFkZXJDaGFuZ2VEZXRlY3Rpb25Qcm9wcyB9O1xuIl19

package/lib/header-change-detection.js

@@ -74,4 +74,4 @@ class HeaderChangeDetection extends constructs_1.Construct {
     }
 }
 exports.HeaderChangeDetection = HeaderChangeDetection;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVhZGVyLWNoYW5nZS1kZXRlY3Rpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9wYWNrYWdlcy9oZWFkZXItY2hhbmdlLWRldGVjdGlvbi9saWIvaGVhZGVyLWNoYW5nZS1kZXRlY3Rpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsNkNBQW9EO0FBQ3BELDJEQUE2RTtBQUM3RSx1REFBbUU7QUFDbkUsdUVBQTBFO0FBQzFFLHVEQUErRTtBQUMvRSwyQ0FBdUM7QUFDdkMsK0JBQTRCO0FBQzVCLHNEQUErQztBQW9EL0MsTUFBTSxPQUFPLEdBQUc7SUFDZCxJQUFJO0lBQ0osSUFBSTtJQUNKLDREQUE0RDtDQUM3RCxDQUFDO0FBRUYsTUFBTSxjQUFjLEdBQUc7SUFDckIseUJBQXlCO0lBQ3pCLHFDQUFxQztJQUNyQyxxQkFBcUI7SUFDckIsMkJBQTJCO0lBQzNCLGlCQUFpQjtJQUNqQix3QkFBd0I7SUFDeEIsNEJBQTRCO0lBQzVCLDhCQUE4QjtJQUM5Qiw4QkFBOEI7SUFDOUIsaUJBQWlCO0lBQ2pCLG1CQUFtQjtJQUNuQixlQUFlO0NBQ2hCLENBQUM7QUFFRixNQUFhLHFCQUFzQixTQUFRLHNCQUFTO0lBQ2xELFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBaUM7O1FBQ3pFLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFakIsTUFBTSxPQUFPLEdBQUcsS0FBSyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUM7UUFFNUQsT0FBTyxDQUFDLElBQUksQ0FDVixHQUFHLENBQUMsQ0FBQSxNQUFBLEtBQUssQ0FBQyxpQkFBaUIsMENBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLFdBQVcsRUFBRSxDQUFDLEtBQUksRUFBRSxDQUFDLENBQ3hFLENBQUM7UUFFRixNQUFNLEtBQUssR0FBRyxJQUFJLG9CQUFLLENBQUMsSUFBSSxFQUFFLE9BQU8sRUFBRTtZQUNyQyxZQUFZLEVBQUU7Z0JBQ1osSUFBSSxFQUFFLEtBQUs7Z0JBQ1gsSUFBSSxFQUFFLDRCQUFhLENBQUMsTUFBTTthQUMzQjtZQUNELFdBQVcsRUFBRSwwQkFBVyxDQUFDLGVBQWU7U0FDekMsQ0FBQyxDQUFDO1FBRUgsTUFBTSxRQUFRLEdBQUcsSUFBSSxpQkFBSSxDQUFDLElBQUksRUFBRSxXQUFXLEVBQUU7WUFDM0MsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRLElBQUkscUJBQVEsQ0FBQyxJQUFJLENBQUMsc0JBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDNUQsR0FBRyxLQUFLLENBQUMsU0FBUztTQUNuQixDQUFDLENBQUM7UUFFSCxNQUFNLE1BQU0sR0FBRyxJQUFJLHFCQUFRLENBQUMsSUFBSSxFQUFFLGFBQWEsRUFBRTtZQUMvQyxZQUFZLEVBQUUseUJBQVksQ0FBQyxNQUFNO1lBQ2pDLE9BQU8sRUFBRSxvQkFBTyxDQUFDLFdBQVc7WUFDNUIsT0FBTyxFQUFFLHNCQUFzQjtZQUMvQixPQUFPLEVBQUUsS0FBSyxDQUFDLGFBQWEsSUFBSSxzQkFBUSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDcEQsSUFBSSxFQUFFLGlCQUFJLENBQUMsU0FBUyxDQUFDLElBQUEsV0FBSSxFQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsRUFBRTtnQkFDOUMsUUFBUSxFQUFFO29CQUNSLE9BQU87b0JBQ1AsS0FBSyxFQUFFLHlCQUFXLENBQUMsWUFBWSxDQUFDLFNBQVMsQ0FBQztvQkFDMUMsS0FBSyxFQUFFLElBQUkscUJBQU8sQ0FBQzt3QkFDakIsV0FBVyxFQUFFLENBQUMsSUFBQSxXQUFJLEVBQUMsU0FBUyxFQUFFLHdCQUF3QixDQUFDLENBQUM7cUJBQ3pELENBQUM7aUJBQ0g7YUFDRixDQUFDO1lBQ0YsV0FBVyxFQUFFO2dCQUNYLElBQUksRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUM7Z0JBQzFCLE9BQU8sRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQztnQkFDMUIsS0FBSyxFQUFFLEtBQUssQ0FBQyxTQUFTO2dCQUN0QixTQUFTLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsUUFBUTtnQkFDeEMsb0JBQW9CLEVBQUUsQ0FBQyxLQUFLLENBQUMsa0JBQWtCLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUM7YUFDdEU7U0FDRixDQUFDLENBQUM7UUFFSCxRQUFRLENBQUMsU0FBUyxDQUFDLElBQUksbUNBQWMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBRS9DLEtBQUssQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDN0IsS0FBSyxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM1QixLQUFLLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDNUMsQ0FBQztDQUNGO0FBcERELHNEQW9EQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IERvY2tlckltYWdlLCBEdXJhdGlvbiB9IGZyb20gXCJhd3MtY2RrLWxpYlwiO1xuaW1wb3J0IHsgQXR0cmlidXRlVHlwZSwgQmlsbGluZ01vZGUsIFRhYmxlIH0gZnJvbSBcImF3cy1jZGstbGliL2F3cy1keW5hbW9kYlwiO1xuaW1wb3J0IHsgUnVsZSwgUnVsZVByb3BzLCBTY2hlZHVsZSB9IGZyb20gXCJhd3MtY2RrLWxpYi9hd3MtZXZlbnRzXCI7XG5pbXBvcnQgeyBMYW1iZGFGdW5jdGlvbiwgU25zVG9waWMgfSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLWV2ZW50cy10YXJnZXRzXCI7XG5pbXBvcnQgeyBBcmNoaXRlY3R1cmUsIENvZGUsIEZ1bmN0aW9uLCBSdW50aW1lIH0gZnJvbSBcImF3cy1jZGstbGliL2F3cy1sYW1iZGFcIjtcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gXCJjb25zdHJ1Y3RzXCI7XG5pbXBvcnQgeyBqb2luIH0gZnJvbSBcInBhdGhcIjtcbmltcG9ydCB7IEVzYnVpbGQgfSBmcm9tIFwiQGFsaWdlbnQvY2RrLWVzYnVpbGRcIjtcblxuZXhwb3J0IGludGVyZmFjZSBIZWFkZXJDaGFuZ2VEZXRlY3Rpb25Qcm9wcyB7XG4gIC8qKlxuICAgKiBMaXN0IG9mIFVSTHMgdG8gbW9uaXRvciBmb3IgaGVhZGVyIGNoYW5nZXNcbiAgICovXG4gIHVybHM6IHN0cmluZ1tdO1xuXG4gIC8qKlxuICAgKiBPcHRpb25hbCBsaXN0IG9mIGFkZGl0aW9uYWwgaGVhZGVycyB0byBtb25pdG9yXG4gICAqXG4gICAqIEBkZWZhdWx0IFtdXG4gICAqL1xuICBhZGRpdGlvbmFsSGVhZGVycz86IHN0cmluZ1tdO1xuXG4gIC8qKlxuICAgKiBPcHRpb25hbGx5IGRpc2FibGUgYWxsIHRoZSBkZWZhdWx0IGhlYWRlcnNcbiAgICpcbiAgICogQGRlZmF1bHQgZmFsc2VcbiAgICovXG4gIGRpc2FibGVEZWZhdWx0cz86IGJvb2xlYW47XG5cbiAgLyoqXG4gICAqIFNOUyBUb3BpYyB0byBzZW5kIGNoYW5nZSBkZXRlY3Rpb24gbm90aWZpY2F0aW9ucyB0b1xuICAgKi9cbiAgc25zVG9waWM6IFNuc1RvcGljO1xuXG4gIC8qKlxuICAgKiBUaGUgc2NoZWR1bGUgZm9yIHBlcmZvcm1pbmcgdGhlIGhlYWRlciBjaGVja1xuICAgKlxuICAgKiBAZGVmYXVsdCBTY2hlZHVsZS5yYXRlKER1cmF0aW9uLmhvdXJzKDEpKVxuICAgKi9cbiAgc2NoZWR1bGU/OiBTY2hlZHVsZTtcblxuICAvKipcbiAgICogT3B0aW9uYWxseSBwYXNzIGFueSBydWxlIHByb3BlcnRpZXNcbiAgICovXG4gIHJ1bGVQcm9wcz86IFBhcnRpYWw8UnVsZVByb3BzPjtcblxuICAvKipcbiAgICogT3B0aW9uYWxseSBhY2NlcHQgSFRUUCBzdGF0dXMgY29kZXMgb3RoZXIgdGhhbiAyMDBcbiAgICpcbiAgICogQGRlZmF1bHQgW1wiMjAwXCJdXG4gICAqL1xuICBhY2NlcHRlZEh0dHBTdGF0dXM/OiBzdHJpbmdbXTtcblxuICAvKipcbiAgICogRm9yIGV4dGVuZGVkIExhbWJkYSB0aW1lb3V0LiBEZWZhdWx0OiAxMCBzZWNvbmRzXG4gICAqL1xuICBsYW1iZGFUaW1lb3V0PzogRHVyYXRpb247XG59XG5cbmNvbnN0IGNvbW1hbmQgPSBbXG4gIFwic2hcIixcbiAgXCItY1wiLFxuICAnZWNobyBcIkRvY2tlciBidWlsZCBub3Qgc3VwcG9ydGVkLiBQbGVhc2UgaW5zdGFsbCBlc2J1aWxkLlwiJyxcbl07XG5cbmNvbnN0IGRlZmF1bHRIZWFkZXJzID0gW1xuICBcImNvbnRlbnQtc2VjdXJpdHktcG9saWN5XCIsXG4gIFwiY29udGVudC1zZWN1cml0eS1wb2xpY3ktcmVwb3J0LW9ubHlcIixcbiAgXCJyZXBvcnRpbmctZW5kcG9pbnRzXCIsXG4gIFwic3RyaWN0LXRyYW5zcG9ydC1zZWN1cml0eVwiLFxuICBcIngtZnJhbWUtb3B0aW9uc1wiLFxuICBcIngtY29udGVudC10eXBlLW9wdGlvbnNcIixcbiAgXCJjcm9zcy1vcmlnaW4tb3BlbmVyLXBvbGljeVwiLFxuICBcImNyb3NzLW9yaWdpbi1lbWJlZGRlci1wb2xpY3lcIixcbiAgXCJjcm9zcy1vcmlnaW4tcmVzb3VyY2UtcG9saWN5XCIsXG4gIFwicmVmZXJyZXItcG9saWN5XCIsXG4gIFwicGVybWlzc2lvbi1wb2xpY3lcIixcbiAgXCJjYWNoZS1jb250cm9sXCIsXG5dO1xuXG5leHBvcnQgY2xhc3MgSGVhZGVyQ2hhbmdlRGV0ZWN0aW9uIGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM6IEhlYWRlckNoYW5nZURldGVjdGlvblByb3BzKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkKTtcblxuICAgIGNvbnN0IGhlYWRlcnMgPSBwcm9wcy5kaXNhYmxlRGVmYXVsdHMgPyBbXSA6IGRlZmF1bHRIZWFkZXJzO1xuXG4gICAgaGVhZGVycy5wdXNoKFxuICAgICAgLi4uKHByb3BzLmFkZGl0aW9uYWxIZWFkZXJzPy5tYXAoaGVhZGVyID0+IGhlYWRlci50b0xvd2VyQ2FzZSgpKSB8fCBbXSlcbiAgICApO1xuXG4gICAgY29uc3QgdGFibGUgPSBuZXcgVGFibGUodGhpcywgXCJUYWJsZVwiLCB7XG4gICAgICBwYXJ0aXRpb25LZXk6IHtcbiAgICAgICAgbmFtZTogXCJVcmxcIixcbiAgICAgICAgdHlwZTogQXR0cmlidXRlVHlwZS5TVFJJTkcsXG4gICAgICB9LFxuICAgICAgYmlsbGluZ01vZGU6IEJpbGxpbmdNb2RlLlBBWV9QRVJfUkVRVUVTVCxcbiAgICB9KTtcblxuICAgIGNvbnN0IHNjaGVkdWxlID0gbmV3IFJ1bGUodGhpcywgXCJFdmVudFJ1bGVcIiwge1xuICAgICAgc2NoZWR1bGU6IHByb3BzLnNjaGVkdWxlIHx8IFNjaGVkdWxlLnJhdGUoRHVyYXRpb24uaG91cnMoMSkpLFxuICAgICAgLi4ucHJvcHMucnVsZVByb3BzLFxuICAgIH0pO1xuXG4gICAgY29uc3QgbGFtYmRhID0gbmV3IEZ1bmN0aW9uKHRoaXMsIFwiSGVhZGVyQ2hlY2tcIiwge1xuICAgICAgYXJjaGl0ZWN0dXJlOiBBcmNoaXRlY3R1cmUuWDg2XzY0LFxuICAgICAgcnVudGltZTogUnVudGltZS5OT0RFSlNfMjJfWCxcbiAgICAgIGhhbmRsZXI6IFwiaGVhZGVyLWNoZWNrLmhhbmRsZXJcIixcbiAgICAgIHRpbWVvdXQ6IHByb3BzLmxhbWJkYVRpbWVvdXQgfHwgRHVyYXRpb24uc2Vjb25kcygxMCksXG4gICAgICBjb2RlOiBDb2RlLmZyb21Bc3NldChqb2luKF9fZGlybmFtZSwgXCJsYW1iZGFcIiksIHtcbiAgICAgICAgYnVuZGxpbmc6IHtcbiAgICAgICAgICBjb21tYW5kLFxuICAgICAgICAgIGltYWdlOiBEb2NrZXJJbWFnZS5mcm9tUmVnaXN0cnkoXCJidXN5Ym94XCIpLFxuICAgICAgICAgIGxvY2FsOiBuZXcgRXNidWlsZCh7XG4gICAgICAgICAgICBlbnRyeVBvaW50czogW2pvaW4oX19kaXJuYW1lLCBcImxhbWJkYS9oZWFkZXItY2hlY2sudHNcIildLFxuICAgICAgICAgIH0pLFxuICAgICAgICB9LFxuICAgICAgfSksXG4gICAgICBlbnZpcm9ubWVudDoge1xuICAgICAgICBVUkxTOiBwcm9wcy51cmxzLmpvaW4oXCIsXCIpLFxuICAgICAgICBIRUFERVJTOiBoZWFkZXJzLmpvaW4oXCIsXCIpLFxuICAgICAgICBUQUJMRTogdGFibGUudGFibGVOYW1lLFxuICAgICAgICBUT1BJQ19BUk46IHByb3BzLnNuc1RvcGljLnRvcGljLnRvcGljQXJuLFxuICAgICAgICBBQ0NFUFRFRF9IVFRQX1NUQVRVUzogKHByb3BzLmFjY2VwdGVkSHR0cFN0YXR1cyB8fCBbXCIyMDBcIl0pLmpvaW4oXCIsXCIpLFxuICAgICAgfSxcbiAgICB9KTtcblxuICAgIHNjaGVkdWxlLmFkZFRhcmdldChuZXcgTGFtYmRhRnVuY3Rpb24obGFtYmRhKSk7XG5cbiAgICB0YWJsZS5ncmFudFdyaXRlRGF0YShsYW1iZGEpO1xuICAgIHRhYmxlLmdyYW50UmVhZERhdGEobGFtYmRhKTtcbiAgICBwcm9wcy5zbnNUb3BpYy50b3BpYy5ncmFudFB1Ymxpc2gobGFtYmRhKTtcbiAgfVxufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVhZGVyLWNoYW5nZS1kZXRlY3Rpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJoZWFkZXItY2hhbmdlLWRldGVjdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSw2Q0FBb0Q7QUFDcEQsMkRBQTZFO0FBQzdFLHVEQUFtRTtBQUNuRSx1RUFBMEU7QUFDMUUsdURBQStFO0FBQy9FLDJDQUF1QztBQUN2QywrQkFBNEI7QUFDNUIsc0RBQStDO0FBb0QvQyxNQUFNLE9BQU8sR0FBRztJQUNkLElBQUk7SUFDSixJQUFJO0lBQ0osNERBQTREO0NBQzdELENBQUM7QUFFRixNQUFNLGNBQWMsR0FBRztJQUNyQix5QkFBeUI7SUFDekIscUNBQXFDO0lBQ3JDLHFCQUFxQjtJQUNyQiwyQkFBMkI7SUFDM0IsaUJBQWlCO0lBQ2pCLHdCQUF3QjtJQUN4Qiw0QkFBNEI7SUFDNUIsOEJBQThCO0lBQzlCLDhCQUE4QjtJQUM5QixpQkFBaUI7SUFDakIsbUJBQW1CO0lBQ25CLGVBQWU7Q0FDaEIsQ0FBQztBQUVGLE1BQWEscUJBQXNCLFNBQVEsc0JBQVM7SUFDbEQsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUFpQzs7UUFDekUsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztRQUVqQixNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsZUFBZSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLGNBQWMsQ0FBQztRQUU1RCxPQUFPLENBQUMsSUFBSSxDQUNWLEdBQUcsQ0FBQyxDQUFBLE1BQUEsS0FBSyxDQUFDLGlCQUFpQiwwQ0FBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUMsS0FBSSxFQUFFLENBQUMsQ0FDeEUsQ0FBQztRQUVGLE1BQU0sS0FBSyxHQUFHLElBQUksb0JBQUssQ0FBQyxJQUFJLEVBQUUsT0FBTyxFQUFFO1lBQ3JDLFlBQVksRUFBRTtnQkFDWixJQUFJLEVBQUUsS0FBSztnQkFDWCxJQUFJLEVBQUUsNEJBQWEsQ0FBQyxNQUFNO2FBQzNCO1lBQ0QsV0FBVyxFQUFFLDBCQUFXLENBQUMsZUFBZTtTQUN6QyxDQUFDLENBQUM7UUFFSCxNQUFNLFFBQVEsR0FBRyxJQUFJLGlCQUFJLENBQUMsSUFBSSxFQUFFLFdBQVcsRUFBRTtZQUMzQyxRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVEsSUFBSSxxQkFBUSxDQUFDLElBQUksQ0FBQyxzQkFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUM1RCxHQUFHLEtBQUssQ0FBQyxTQUFTO1NBQ25CLENBQUMsQ0FBQztRQUVILE1BQU0sTUFBTSxHQUFHLElBQUkscUJBQVEsQ0FBQyxJQUFJLEVBQUUsYUFBYSxFQUFFO1lBQy9DLFlBQVksRUFBRSx5QkFBWSxDQUFDLE1BQU07WUFDakMsT0FBTyxFQUFFLG9CQUFPLENBQUMsV0FBVztZQUM1QixPQUFPLEVBQUUsc0JBQXNCO1lBQy9CLE9BQU8sRUFBRSxLQUFLLENBQUMsYUFBYSxJQUFJLHNCQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNwRCxJQUFJLEVBQUUsaUJBQUksQ0FBQyxTQUFTLENBQUMsSUFBQSxXQUFJLEVBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxFQUFFO2dCQUM5QyxRQUFRLEVBQUU7b0JBQ1IsT0FBTztvQkFDUCxLQUFLLEVBQUUseUJBQVcsQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUFDO29CQUMxQyxLQUFLLEVBQUUsSUFBSSxxQkFBTyxDQUFDO3dCQUNqQixXQUFXLEVBQUUsQ0FBQyxJQUFBLFdBQUksRUFBQyxTQUFTLEVBQUUsd0JBQXdCLENBQUMsQ0FBQztxQkFDekQsQ0FBQztpQkFDSDthQUNGLENBQUM7WUFDRixXQUFXLEVBQUU7Z0JBQ1gsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQztnQkFDMUIsT0FBTyxFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDO2dCQUMxQixLQUFLLEVBQUUsS0FBSyxDQUFDLFNBQVM7Z0JBQ3RCLFNBQVMsRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxRQUFRO2dCQUN4QyxvQkFBb0IsRUFBRSxDQUFDLEtBQUssQ0FBQyxrQkFBa0IsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQzthQUN0RTtTQUNGLENBQUMsQ0FBQztRQUVILFFBQVEsQ0FBQyxTQUFTLENBQUMsSUFBSSxtQ0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFFL0MsS0FBSyxDQUFDLGNBQWMsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM3QixLQUFLLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzVCLEtBQUssQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUM1QyxDQUFDO0NBQ0Y7QUFwREQsc0RBb0RDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgRG9ja2VySW1hZ2UsIER1cmF0aW9uIH0gZnJvbSBcImF3cy1jZGstbGliXCI7XG5pbXBvcnQgeyBBdHRyaWJ1dGVUeXBlLCBCaWxsaW5nTW9kZSwgVGFibGUgfSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLWR5bmFtb2RiXCI7XG5pbXBvcnQgeyBSdWxlLCBSdWxlUHJvcHMsIFNjaGVkdWxlIH0gZnJvbSBcImF3cy1jZGstbGliL2F3cy1ldmVudHNcIjtcbmltcG9ydCB7IExhbWJkYUZ1bmN0aW9uLCBTbnNUb3BpYyB9IGZyb20gXCJhd3MtY2RrLWxpYi9hd3MtZXZlbnRzLXRhcmdldHNcIjtcbmltcG9ydCB7IEFyY2hpdGVjdHVyZSwgQ29kZSwgRnVuY3Rpb24sIFJ1bnRpbWUgfSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLWxhbWJkYVwiO1xuaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSBcImNvbnN0cnVjdHNcIjtcbmltcG9ydCB7IGpvaW4gfSBmcm9tIFwicGF0aFwiO1xuaW1wb3J0IHsgRXNidWlsZCB9IGZyb20gXCJAYWxpZ2VudC9jZGstZXNidWlsZFwiO1xuXG5leHBvcnQgaW50ZXJmYWNlIEhlYWRlckNoYW5nZURldGVjdGlvblByb3BzIHtcbiAgLyoqXG4gICAqIExpc3Qgb2YgVVJMcyB0byBtb25pdG9yIGZvciBoZWFkZXIgY2hhbmdlc1xuICAgKi9cbiAgdXJsczogc3RyaW5nW107XG5cbiAgLyoqXG4gICAqIE9wdGlvbmFsIGxpc3Qgb2YgYWRkaXRpb25hbCBoZWFkZXJzIHRvIG1vbml0b3JcbiAgICpcbiAgICogQGRlZmF1bHQgW11cbiAgICovXG4gIGFkZGl0aW9uYWxIZWFkZXJzPzogc3RyaW5nW107XG5cbiAgLyoqXG4gICAqIE9wdGlvbmFsbHkgZGlzYWJsZSBhbGwgdGhlIGRlZmF1bHQgaGVhZGVyc1xuICAgKlxuICAgKiBAZGVmYXVsdCBmYWxzZVxuICAgKi9cbiAgZGlzYWJsZURlZmF1bHRzPzogYm9vbGVhbjtcblxuICAvKipcbiAgICogU05TIFRvcGljIHRvIHNlbmQgY2hhbmdlIGRldGVjdGlvbiBub3RpZmljYXRpb25zIHRvXG4gICAqL1xuICBzbnNUb3BpYzogU25zVG9waWM7XG5cbiAgLyoqXG4gICAqIFRoZSBzY2hlZHVsZSBmb3IgcGVyZm9ybWluZyB0aGUgaGVhZGVyIGNoZWNrXG4gICAqXG4gICAqIEBkZWZhdWx0IFNjaGVkdWxlLnJhdGUoRHVyYXRpb24uaG91cnMoMSkpXG4gICAqL1xuICBzY2hlZHVsZT86IFNjaGVkdWxlO1xuXG4gIC8qKlxuICAgKiBPcHRpb25hbGx5IHBhc3MgYW55IHJ1bGUgcHJvcGVydGllc1xuICAgKi9cbiAgcnVsZVByb3BzPzogUGFydGlhbDxSdWxlUHJvcHM+O1xuXG4gIC8qKlxuICAgKiBPcHRpb25hbGx5IGFjY2VwdCBIVFRQIHN0YXR1cyBjb2RlcyBvdGhlciB0aGFuIDIwMFxuICAgKlxuICAgKiBAZGVmYXVsdCBbXCIyMDBcIl1cbiAgICovXG4gIGFjY2VwdGVkSHR0cFN0YXR1cz86IHN0cmluZ1tdO1xuXG4gIC8qKlxuICAgKiBGb3IgZXh0ZW5kZWQgTGFtYmRhIHRpbWVvdXQuIERlZmF1bHQ6IDEwIHNlY29uZHNcbiAgICovXG4gIGxhbWJkYVRpbWVvdXQ/OiBEdXJhdGlvbjtcbn1cblxuY29uc3QgY29tbWFuZCA9IFtcbiAgXCJzaFwiLFxuICBcIi1jXCIsXG4gICdlY2hvIFwiRG9ja2VyIGJ1aWxkIG5vdCBzdXBwb3J0ZWQuIFBsZWFzZSBpbnN0YWxsIGVzYnVpbGQuXCInLFxuXTtcblxuY29uc3QgZGVmYXVsdEhlYWRlcnMgPSBbXG4gIFwiY29udGVudC1zZWN1cml0eS1wb2xpY3lcIixcbiAgXCJjb250ZW50LXNlY3VyaXR5LXBvbGljeS1yZXBvcnQtb25seVwiLFxuICBcInJlcG9ydGluZy1lbmRwb2ludHNcIixcbiAgXCJzdHJpY3QtdHJhbnNwb3J0LXNlY3VyaXR5XCIsXG4gIFwieC1mcmFtZS1vcHRpb25zXCIsXG4gIFwieC1jb250ZW50LXR5cGUtb3B0aW9uc1wiLFxuICBcImNyb3NzLW9yaWdpbi1vcGVuZXItcG9saWN5XCIsXG4gIFwiY3Jvc3Mtb3JpZ2luLWVtYmVkZGVyLXBvbGljeVwiLFxuICBcImNyb3NzLW9yaWdpbi1yZXNvdXJjZS1wb2xpY3lcIixcbiAgXCJyZWZlcnJlci1wb2xpY3lcIixcbiAgXCJwZXJtaXNzaW9uLXBvbGljeVwiLFxuICBcImNhY2hlLWNvbnRyb2xcIixcbl07XG5cbmV4cG9ydCBjbGFzcyBIZWFkZXJDaGFuZ2VEZXRlY3Rpb24gZXh0ZW5kcyBDb25zdHJ1Y3Qge1xuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogSGVhZGVyQ2hhbmdlRGV0ZWN0aW9uUHJvcHMpIHtcbiAgICBzdXBlcihzY29wZSwgaWQpO1xuXG4gICAgY29uc3QgaGVhZGVycyA9IHByb3BzLmRpc2FibGVEZWZhdWx0cyA/IFtdIDogZGVmYXVsdEhlYWRlcnM7XG5cbiAgICBoZWFkZXJzLnB1c2goXG4gICAgICAuLi4ocHJvcHMuYWRkaXRpb25hbEhlYWRlcnM/Lm1hcChoZWFkZXIgPT4gaGVhZGVyLnRvTG93ZXJDYXNlKCkpIHx8IFtdKVxuICAgICk7XG5cbiAgICBjb25zdCB0YWJsZSA9IG5ldyBUYWJsZSh0aGlzLCBcIlRhYmxlXCIsIHtcbiAgICAgIHBhcnRpdGlvbktleToge1xuICAgICAgICBuYW1lOiBcIlVybFwiLFxuICAgICAgICB0eXBlOiBBdHRyaWJ1dGVUeXBlLlNUUklORyxcbiAgICAgIH0sXG4gICAgICBiaWxsaW5nTW9kZTogQmlsbGluZ01vZGUuUEFZX1BFUl9SRVFVRVNULFxuICAgIH0pO1xuXG4gICAgY29uc3Qgc2NoZWR1bGUgPSBuZXcgUnVsZSh0aGlzLCBcIkV2ZW50UnVsZVwiLCB7XG4gICAgICBzY2hlZHVsZTogcHJvcHMuc2NoZWR1bGUgfHwgU2NoZWR1bGUucmF0ZShEdXJhdGlvbi5ob3VycygxKSksXG4gICAgICAuLi5wcm9wcy5ydWxlUHJvcHMsXG4gICAgfSk7XG5cbiAgICBjb25zdCBsYW1iZGEgPSBuZXcgRnVuY3Rpb24odGhpcywgXCJIZWFkZXJDaGVja1wiLCB7XG4gICAgICBhcmNoaXRlY3R1cmU6IEFyY2hpdGVjdHVyZS5YODZfNjQsXG4gICAgICBydW50aW1lOiBSdW50aW1lLk5PREVKU18yMl9YLFxuICAgICAgaGFuZGxlcjogXCJoZWFkZXItY2hlY2suaGFuZGxlclwiLFxuICAgICAgdGltZW91dDogcHJvcHMubGFtYmRhVGltZW91dCB8fCBEdXJhdGlvbi5zZWNvbmRzKDEwKSxcbiAgICAgIGNvZGU6IENvZGUuZnJvbUFzc2V0KGpvaW4oX19kaXJuYW1lLCBcImxhbWJkYVwiKSwge1xuICAgICAgICBidW5kbGluZzoge1xuICAgICAgICAgIGNvbW1hbmQsXG4gICAgICAgICAgaW1hZ2U6IERvY2tlckltYWdlLmZyb21SZWdpc3RyeShcImJ1c3lib3hcIiksXG4gICAgICAgICAgbG9jYWw6IG5ldyBFc2J1aWxkKHtcbiAgICAgICAgICAgIGVudHJ5UG9pbnRzOiBbam9pbihfX2Rpcm5hbWUsIFwibGFtYmRhL2hlYWRlci1jaGVjay50c1wiKV0sXG4gICAgICAgICAgfSksXG4gICAgICAgIH0sXG4gICAgICB9KSxcbiAgICAgIGVudmlyb25tZW50OiB7XG4gICAgICAgIFVSTFM6IHByb3BzLnVybHMuam9pbihcIixcIiksXG4gICAgICAgIEhFQURFUlM6IGhlYWRlcnMuam9pbihcIixcIiksXG4gICAgICAgIFRBQkxFOiB0YWJsZS50YWJsZU5hbWUsXG4gICAgICAgIFRPUElDX0FSTjogcHJvcHMuc25zVG9waWMudG9waWMudG9waWNBcm4sXG4gICAgICAgIEFDQ0VQVEVEX0hUVFBfU1RBVFVTOiAocHJvcHMuYWNjZXB0ZWRIdHRwU3RhdHVzIHx8IFtcIjIwMFwiXSkuam9pbihcIixcIiksXG4gICAgICB9LFxuICAgIH0pO1xuXG4gICAgc2NoZWR1bGUuYWRkVGFyZ2V0KG5ldyBMYW1iZGFGdW5jdGlvbihsYW1iZGEpKTtcblxuICAgIHRhYmxlLmdyYW50V3JpdGVEYXRhKGxhbWJkYSk7XG4gICAgdGFibGUuZ3JhbnRSZWFkRGF0YShsYW1iZGEpO1xuICAgIHByb3BzLnNuc1RvcGljLnRvcGljLmdyYW50UHVibGlzaChsYW1iZGEpO1xuICB9XG59XG4iXX0=

package/package.json

@@ -1,35 +1,39 @@
 {
   "name": "@aligent/cdk-header-change-detection",
+  "version": "1.7.1",
   "main": "index.js",
   "license": "MIT",
-  "homepage": "https://github.com/aligent/cdk-constructs/packages/header-change-detection-stack#readme",
+  "homepage": "https://github.com/aligent/aws-cdk-constructs/tree/main/packages/header-change-detection#readme",
   "repository": {
     "type": "git",
-    "url": "https://github.com/aligent/aws-cdk-header-change-detection-stack"
+    "url": "git+https://github.com/aligent/aws-cdk-constructs.git"
+  },
+  "bugs": {
+    "url": "https://github.com/aligent/aws-cdk-constructs/issues"
   },
   "types": "index.d.ts",
   "scripts": {
-    "build": "tsc"
+    "build": "tsc",
+    "test": "npx nx test header-change-detection",
+    "lint": "npx nx lint header-change-detection"
   },
   "devDependencies": {
     "@types/jest": "^29.5.10",
     "@types/node": "^20.6.3",
-    "aws-cdk": "^2.113.0",
+    "aws-cdk": "^2.1019.1",
     "jest": "^29.7.0",
     "ts-jest": "^29.1.1",
     "ts-node": "^10.9.1",
     "typescript": "^5.3.2"
   },
   "dependencies": {
-    "@aws-sdk/client-dynamodb": "^3.726.1",
-    "@aws-sdk/client-sns": "3.732.0",
+    "@aws-sdk/client-dynamodb": "^3.830.0",
+    "@aws-sdk/client-sns": "3.830.0",
     "axios": "^1.8.3",
     "source-map-support": "^0.5.21"
   },
   "peerDependencies": {
     "aws-cdk-lib": "^2.168.0",
     "constructs": "^10.4.2"
-  },
-  "type": "commonjs",
-  "version": "1.6.1"
-}
+  }
+}

package/lib/lambda/header-check.ts

@@ -1,360 +0,0 @@
-// We know the environment variables will exist so safe to ignore this
-/* eslint-disable @typescript-eslint/no-non-null-assertion */
-
-import axios from "axios";
-import {
-  DynamoDBClient,
-  BatchGetItemCommand,
-  BatchGetItemCommandInput,
-  KeysAndAttributes,
-  UpdateItemCommandInput,
-  UpdateItemCommand,
-  AttributeValueUpdate,
-  UpdateItemCommandOutput,
-} from "@aws-sdk/client-dynamodb";
-import { PublishCommand, PublishInput, SNSClient } from "@aws-sdk/client-sns";
-
-const URLS = process.env.URLS;
-const HEADERS = process.env.HEADERS;
-const TABLE = process.env.TABLE!;
-
-const config = "";
-const DB_CLIENT = new DynamoDBClient(config);
-
-const securityHeaders = HEADERS?.split(",") || [];
-
-// Accept status 200 default
-const ACCEPTED_HTTP_STATUS = (process.env.ACCEPTED_HTTP_STATUS || "200")
-  .split(",")
-  .map(code => parseInt(code.trim(), 10));
-
-console.log("ACCEPTED_HTTP_STATUS:", ACCEPTED_HTTP_STATUS);
-
-type Headers = Map<string, string | undefined>;
-
-// A map of URLs and their headers
-type URLHeaders = Map<string, Headers>;
-
-export const handler = async () => {
-  const urls = URLS?.split(",") || [];
-
-  // Fetch stored headers
-  const [storedUrlHeaders, currentUrlHeaders] = await Promise.all([
-    getStoredValues(urls),
-    fetchHeaders(urls),
-  ]);
-
-  // Find any differences between the headers
-  const headerDifferences = new Map<string, Difference[]>();
-  let differencesDetected = false;
-  const dbUpdates = urls.map(url => {
-    const currentHeaders = currentUrlHeaders.get(url);
-    const storedHeaders =
-      storedUrlHeaders.get(url) || new Map<string, string | undefined>();
-
-    if (!currentHeaders)
-      throw new Error(`Could not get current headers for ${url}`);
-
-    // Check all headers that we care about
-    headerDifferences.set(
-      url,
-      compareHeaders(securityHeaders, storedHeaders, currentHeaders)
-    );
-
-    const headersToUpdate: Headers = new Map<string, string | undefined>();
-    headerDifferences.get(url)?.forEach(difference => {
-      headersToUpdate.set(difference.header, difference.currentValue);
-      differencesDetected = true;
-    });
-
-    return updateStoredValues(url, headersToUpdate);
-  });
-
-  await Promise.all(dbUpdates);
-
-  if (differencesDetected)
-    await sendToSns(formatDifferences(headerDifferences));
-};
-
-/**
- * Fetch security headers for the given urls
- *
- * @param urls list of urls to fetch headers from
- */
-const fetchHeaders = async (urls: string[]): Promise<URLHeaders> => {
-  const currentUrlHeaders: URLHeaders = new Map<string, Headers>();
-
-  // Make an axios request for each url
-  await Promise.all(
-    urls.map(url =>
-      axios.get(url, { validateStatus: () => true }).then(response => {
-        if (!ACCEPTED_HTTP_STATUS.includes(response.status)) {
-          console.warn(
-            `Skipping ${url} — status ${response.status} not allowed`
-          );
-          return;
-        }
-
-        const headers: Headers = new Map<string, string | undefined>();
-
-        Object.entries(response.headers).forEach(([headerName, value]) => {
-          if (securityHeaders?.includes(headerName))
-            headers.set(headerName, value as string);
-        });
-
-        currentUrlHeaders.set(url, headers);
-      })
-    )
-  );
-
-  return currentUrlHeaders;
-};
-
-/**
- * Get values stored in DynamoDB table from a list of string keys.
- * Assumes the call is made to the header change detection table.
- * This table has a primary key of Url (string) with an unknown
- * number of string fields.
- *
- * @param keys array of strings
- */
-const getStoredValues = async (keys: string[]): Promise<URLHeaders> => {
-  if (keys.length === 0) {
-    console.log("No keys were passed");
-    return new Map<string, Headers>();
-  }
-
-  // Construct the command input
-  const primaryKeys = keys.map(url => {
-    return {
-      Url: {
-        S: url,
-      },
-    };
-  });
-  const requestItems = {
-    [TABLE]: {
-      Keys: primaryKeys,
-    },
-  };
-
-  return dynamoBatchRequest(requestItems);
-};
-
-/**
- * Update stored headers for the given url.
- * If the header no longer has a value, delete it. Otherwise update it.
- *
- * @param url the url to update - this is the primary key
- * @param headers record of headers to update
- */
-const updateStoredValues = async (
-  url: string,
-  headers: Headers
-): Promise<UpdateItemCommandOutput | undefined> => {
-  // Convert headers to attribute value update attributes
-  const attributes: Record<string, AttributeValueUpdate> = {};
-  headers.forEach((value, headerName) => {
-    // If the value exists update it, otherwise remove it
-    if (value) {
-      attributes[headerName] = {
-        Value: {
-          S: Array.isArray(value) ? value.join("; ") : value,
-        },
-        Action: "PUT",
-      };
-    } else {
-      attributes[headerName] = {
-        Action: "DELETE",
-      };
-    }
-  });
-
-  if (Object.values(attributes).length === 0) {
-    console.log(`No attribute value changes for ${url}`);
-    return;
-  }
-
-  return dynamoUpdateRequest(url, attributes);
-};
-
-/**
- * Recursive function to get multiple items from a DynamoDB table
- *
- * @param requestItems
- * @returns Promise<URLHeaders>
- */
-const dynamoBatchRequest = async (
-  requestItems: Record<string, KeysAndAttributes> | undefined
-): Promise<URLHeaders> => {
-  console.log(
-    `Starting batch request with items: ${JSON.stringify(requestItems)}`
-  );
-
-  // Validate that request items has values
-  if (Object.keys(requestItems || {})?.length === 0)
-    return new Map<string, Headers>();
-
-  const batchGetInput: BatchGetItemCommandInput = {
-    RequestItems: requestItems,
-  };
-  const batchGetCommand = new BatchGetItemCommand(batchGetInput);
-
-  // Fetch stored stored headers
-  const response = await DB_CLIENT.send(batchGetCommand);
-  const responses = response.Responses?.[TABLE];
-
-  if (!responses) return new Map<string, Headers>();
-
-  console.log(
-    `Got following data from dynamo table: ${JSON.stringify(responses)}`
-  );
-
-  const storedUrlHeaders: URLHeaders = new Map<string, Headers>();
-  Object.values(responses).forEach(headers => {
-    const urlHeaders: Headers = new Map<string, string | undefined>();
-
-    let url = "";
-    Object.entries(headers).forEach(([headerName, value]) => {
-      if (headerName === "Url") {
-        url = value.S!;
-      } else {
-        urlHeaders.set(headerName, value.S!);
-      }
-    });
-    storedUrlHeaders.set(url, urlHeaders);
-  });
-
-  // Process any remaining keys
-  const nextUrlHeaders = await dynamoBatchRequest(response.UnprocessedKeys);
-
-  // Merge data into one object and return
-  return new Map<string, Headers>([...storedUrlHeaders, ...nextUrlHeaders]);
-};
-
-/**
- * Send an update command to DynamoDB
- *
- * @param url the url to update - this is the primary key
- * @param attributes Record<string, AttributeValueUpdate>
- */
-const dynamoUpdateRequest = async (
-  url: string,
-  attributes: Record<string, AttributeValueUpdate>
-): Promise<UpdateItemCommandOutput> => {
-  console.log(
-    `Updating ${url} in table with: ${JSON.stringify(Object.entries(attributes))}`
-  );
-
-  const updateItemInput: UpdateItemCommandInput = {
-    TableName: TABLE,
-    Key: {
-      Url: {
-        S: url,
-      },
-    },
-    AttributeUpdates: attributes,
-  };
-  const updateItemCommand = new UpdateItemCommand(updateItemInput);
-
-  return DB_CLIENT.send(updateItemCommand);
-};
-
-interface Difference {
-  header: string;
-  storedValue: string | undefined;
-  currentValue: string | undefined;
-}
-
-/**
- * Compare values of two lists of headers. Return any headers that have differences
- * along with their stored and current values.
- *
- * @param headers list of headers we want to compare
- * @param stored list of headers that were last found on the site
- * @param current list of headers currently on the site
- * @returns
- */
-const compareHeaders = (
-  headers: string[],
-  stored: Headers,
-  current: Headers
-): Difference[] => {
-  const differences: Difference[] = [];
-
-  headers.forEach(header => {
-    const currentValue = current.get(header);
-    const storedValue = stored.get(header);
-
-    if (currentValue !== storedValue) {
-      differences.push({
-        header,
-        storedValue: storedValue,
-        currentValue: currentValue,
-      });
-    }
-  });
-
-  return differences;
-};
-
-/**
- * Format the differences so they can be easily read in an email.
- *
- * Outputs a string that looks like this:
- *
- * Headers differences found:
- * == https://aligent.com.au/ ===
- *
- * Header: example-header-name
- * Stored Value: No stored value
- * Current Value: example-value
- *
- * === https://aligent.com.au/contact ===
- *
- * Header: example-header-name
- * Stored Value: No stored value
- * Current Value: example-value
- *
- * Header: example-header-name-2
- * Stored Value: previous-value
- * Current Value: new-example-value
- *
- * @param differences Map<string, Difference[]> where the key is the URL
- */
-const formatDifferences = (differences: Map<string, Difference[]>): string => {
-  const message = Array.from(differences.keys()).reduce((text, url) => {
-    console.log(text, url);
-    // Skip the url if there are no differences
-    if (differences.get(url)?.length === 0) {
-      return text;
-    }
-
-    // Format headers nicely
-    const headers = differences.get(url)?.reduce((headerText, header) => {
-      return (headerText += `\r\nHeader: ${header.header}\r\nStored Value: ${header.storedValue}\r\nCurrent Value: ${header.currentValue}\r\n`);
-    }, "");
-
-    return `${text}\r\n=== ${url} ===\r\n ${headers}`;
-  }, "");
-
-  return `Header differences found${message}`;
-};
-
-const TOPIC_ARN = process.env.TOPIC_ARN!;
-const SNS_CLIENT = new SNSClient();
-
-/**
- * Send a message to the SNS topic
- *
- * @param message string to send to sns
- */
-const sendToSns = async (message: string) => {
-  const publishInput: PublishInput = {
-    TopicArn: TOPIC_ARN,
-    Message: message,
-    Subject: "Security Header Change detected",
-  };
-  const publishCommand = new PublishCommand(publishInput);
-  await SNS_CLIENT.send(publishCommand);
-};