@anthusai/papyrus 1.0.0-next.42 → 1.0.0-next.43

package/amplify/revalidate-secret-policy.js

@@ -0,0 +1,13 @@
+/**
+ * IAM statement for the content-actions Lambda's read of the revalidate secret.
+ * Pure (no CDK imports) so the policy can be tested without synthesizing.
+ * The Lambda reads the parameter through boto3 get_parameters (plural), so the
+ * plural action must be granted alongside the singular one.
+ */
+export const REVALIDATE_SECRET_READ_ACTIONS = ["ssm:GetParameter", "ssm:GetParameters"];
+export function revalidateSecretReadStatement(input) {
+    return {
+        actions: REVALIDATE_SECRET_READ_ACTIONS,
+        resources: [`arn:${input.partition}:ssm:${input.region}:${input.account}:parameter${input.parameterName}`],
+    };
+}

package/amplify/revalidate-secret-policy.ts

@@ -0,0 +1,19 @@
+/**
+ * IAM statement for the content-actions Lambda's read of the revalidate secret.
+ * Pure (no CDK imports) so the policy can be tested without synthesizing.
+ * The Lambda reads the parameter through boto3 get_parameters (plural), so the
+ * plural action must be granted alongside the singular one.
+ */
+export const REVALIDATE_SECRET_READ_ACTIONS = ["ssm:GetParameter", "ssm:GetParameters"];
+
+export function revalidateSecretReadStatement(input: {
+  partition: string;
+  region: string;
+  account: string;
+  parameterName: string;
+}): { actions: string[]; resources: string[] } {
+  return {
+    actions: REVALIDATE_SECRET_READ_ACTIONS,
+    resources: [`arn:${input.partition}:ssm:${input.region}:${input.account}:parameter${input.parameterName}`],
+  };
+}

package/amplify/site-backend.js

@@ -8,6 +8,7 @@ import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { DEFAULT_RESOLVER_WAVE_SIZE, orderModelStacksInWaves } from "./resolver-waves.js";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings.js";
+import { revalidateSecretReadStatement } from "./revalidate-secret-policy.js";
 import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource.js";
 import { data } from "./data/resource.js";
 import { assignmentAction } from "./functions/assignment-action/resource.js";
@@ -309,10 +310,12 @@ export function defineSiteBackend(papyrusSite) {
         }
         backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET_PARAMETER", revalidateSecretParameter);
         const revalidateStack = Stack.of(contentActionsLambda);
-        contentActionsLambda.addToRolePolicy(new PolicyStatement({
-            actions: ["ssm:GetParameter"],
-            resources: [`arn:${revalidateStack.partition}:ssm:${revalidateStack.region}:${revalidateStack.account}:parameter${revalidateSecretParameter}`],
-        }));
+        contentActionsLambda.addToRolePolicy(new PolicyStatement(revalidateSecretReadStatement({
+            partition: revalidateStack.partition,
+            region: revalidateStack.region,
+            account: revalidateStack.account,
+            parameterName: revalidateSecretParameter,
+        })));
     }
     grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);
     grantMediaReadWriteDelete(backend.modelAttachmentUpload.resources.lambda);

package/amplify/site-backend.ts

@@ -11,6 +11,7 @@ import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { DEFAULT_RESOLVER_WAVE_SIZE, orderModelStacksInWaves } from "./resolver-waves";
 import { rebuildTriggerSettings } from "./rebuild-trigger-settings";
+import { revalidateSecretReadStatement } from "./revalidate-secret-policy";
 import { applyCognitoDomainPrefix, authConfigFromEnv, defineSiteAuth } from "./auth/resource";
 import { data } from "./data/resource";
 import { assignmentAction } from "./functions/assignment-action/resource";
@@ -398,10 +399,14 @@ export function defineSiteBackend(papyrusSite: PapyrusSite) {
     backend.contentActions.addEnvironment("PAPYRUS_REVALIDATE_SECRET_PARAMETER", revalidateSecretParameter);
     const revalidateStack = Stack.of(contentActionsLambda);
     contentActionsLambda.addToRolePolicy(
-      new PolicyStatement({
-        actions: ["ssm:GetParameter"],
-        resources: [`arn:${revalidateStack.partition}:ssm:${revalidateStack.region}:${revalidateStack.account}:parameter${revalidateSecretParameter}`],
-      }),
+      new PolicyStatement(
+        revalidateSecretReadStatement({
+          partition: revalidateStack.partition,
+          region: revalidateStack.region,
+          account: revalidateStack.account,
+          parameterName: revalidateSecretParameter,
+        }),
+      ),
     );
   }
   grantNewsroomReadWriteDelete(backend.modelAttachmentUpload.resources.lambda as LambdaFunction);

package/package.json

@@ -302,7 +302,7 @@
       "optional": true
     }
   },
-  "version": "1.0.0-next.42",
+  "version": "1.0.0-next.43",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-next.42",
+  "version": "1.0.0-next.43",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",