@anthusai/papyrus 2.0.0-next.11 → 2.0.0-next.110

package/infra/cloud-email.test.js

@@ -0,0 +1,69 @@
+import assert from "node:assert/strict";
+import { App } from "aws-cdk-lib";
+import { Template } from "aws-cdk-lib/assertions";
+import { AmplifyAppShellStack } from "./amplify-app-shell.js";
+import { parseSiteConfig } from "./site-config.js";
+const base = () => ({
+    siteId: "example", repository: "https://github.com/example/publication", brand: "example",
+    frontend: "markus-static", papyrusVersion: "5.32.0", autoDeploy: false,
+    cms: { cognitoDomainPrefix: "example-cms", staging: false,
+        environment: { PAPYRUS_OAUTH_REDIRECT_URLS: "http://localhost:3001/" } },
+});
+function synth(raw) {
+    const app = new App();
+    return Template.fromStack(new AmplifyAppShellStack(app, "EmailTest", parseSiteConfig(raw), {
+        env: { account: "123456789012", region: "us-east-1" },
+    }));
+}
+const checks = {
+    managed() {
+        const template = synth({ ...base(), email: { mode: "managed", sendingDomain: "news.example.test" } });
+        template.resourceCountIs("AWS::SES::EmailIdentity", 1);
+        template.resourceCountIs("AWS::SES::ConfigurationSet", 1);
+        template.resourceCountIs("AWS::Route53::RecordSet", 0);
+        template.resourceCountIs("AWS::SES::ReceiptRuleSet", 0);
+        template.hasResourceProperties("AWS::SES::EmailIdentity", { EmailIdentity: "news.example.test" });
+        template.hasResourceProperties("AWS::SNS::Topic", { TopicName: "papyrus-newsletter-events-example" });
+        template.hasResourceProperties("AWS::SES::ConfigurationSetEventDestination", {
+            EventDestination: { Name: "cloudwatch-metrics", MatchingEventTypes: ["SEND", "BOUNCE", "COMPLAINT"],
+                CloudWatchDestination: { DimensionConfigurations: [{ DimensionName: "ses:configuration-set",
+                            DimensionValueSource: "MESSAGE_TAG", DefaultDimensionValue: "papyrus-example" }] } },
+        });
+        const text = JSON.stringify(template.toJSON());
+        assert.ok(text.includes("PAPYRUS_EMAIL_FROM_ADDRESS"));
+        assert.ok(text.includes("notifications@news.example.test"));
+        assert.ok(text.includes("EmailDkimRecord1Name"));
+        assert.ok(!text.includes("ses:SendEmail"), "identity setup does not grant unsolicited sending authority");
+    },
+    existing() {
+        const template = synth({ ...base(), email: { mode: "existing", sendingDomain: "news.example.test",
+                configurationSet: "already-owned", eventTopicName: "already-owned-events" } });
+        template.resourceCountIs("AWS::SES::EmailIdentity", 0);
+        template.resourceCountIs("AWS::SES::ConfigurationSet", 0);
+        template.resourceCountIs("AWS::SNS::Topic", 0);
+        assert.ok(JSON.stringify(template.toJSON()).includes("already-owned"));
+    },
+    static() {
+        const raw = { ...base(), reader: { buildCommand: "make site", baseDirectory: "dist" } };
+        delete raw.cms;
+        const template = synth(raw);
+        template.resourceCountIs("AWS::SES::EmailIdentity", 0);
+        template.resourceCountIs("AWS::SES::ConfigurationSet", 0);
+        template.resourceCountIs("AWS::SES::ReceiptRule", 0);
+    },
+    missing() {
+        assert.throws(() => parseSiteConfig(base()), /email.*required.*cloud/i);
+        assert.throws(() => parseSiteConfig({ ...base(), email: { mode: "existing", sendingDomain: "news.example.test" } }), /email.configurationSet/);
+    },
+};
+export function runCloudEmailTests(selected) {
+    if (selected) {
+        assert.ok(checks[selected], selected);
+        checks[selected]();
+    }
+    else
+        for (const check of Object.values(checks))
+            check();
+    console.log("cloud email infrastructure: ok");
+}
+runCloudEmailTests(process.argv[2]);

package/infra/cloud-email.test.ts

@@ -0,0 +1,66 @@
+import assert from "node:assert/strict";
+import { App } from "aws-cdk-lib";
+import { Template } from "aws-cdk-lib/assertions";
+import { AmplifyAppShellStack } from "./amplify-app-shell";
+import { parseSiteConfig } from "./site-config";
+
+const base = () => ({
+  siteId: "example", repository: "https://github.com/example/publication", brand: "example",
+  frontend: "markus-static", papyrusVersion: "5.32.0", autoDeploy: false,
+  cms: { cognitoDomainPrefix: "example-cms", staging: false,
+    environment: { PAPYRUS_OAUTH_REDIRECT_URLS: "http://localhost:3001/" } },
+});
+function synth(raw: unknown) {
+  const app = new App();
+  return Template.fromStack(new AmplifyAppShellStack(app, "EmailTest", parseSiteConfig(raw), {
+    env: { account: "123456789012", region: "us-east-1" },
+  }));
+}
+const checks: Record<string, () => void> = {
+  managed() {
+    const template = synth({ ...base(), email: { mode: "managed", sendingDomain: "news.example.test" } });
+    template.resourceCountIs("AWS::SES::EmailIdentity", 1);
+    template.resourceCountIs("AWS::SES::ConfigurationSet", 1);
+    template.resourceCountIs("AWS::Route53::RecordSet", 0);
+    template.resourceCountIs("AWS::SES::ReceiptRuleSet", 0);
+    template.hasResourceProperties("AWS::SES::EmailIdentity", { EmailIdentity: "news.example.test" });
+    template.hasResourceProperties("AWS::SNS::Topic", { TopicName: "papyrus-newsletter-events-example" });
+    template.hasResourceProperties("AWS::SES::ConfigurationSetEventDestination", {
+      EventDestination: { Name: "cloudwatch-metrics", MatchingEventTypes: ["SEND", "BOUNCE", "COMPLAINT"],
+        CloudWatchDestination: { DimensionConfigurations: [{ DimensionName: "ses:configuration-set",
+          DimensionValueSource: "MESSAGE_TAG", DefaultDimensionValue: "papyrus-example" }] } },
+    });
+    const text = JSON.stringify(template.toJSON());
+    assert.ok(text.includes("PAPYRUS_EMAIL_FROM_ADDRESS"));
+    assert.ok(text.includes("notifications@news.example.test"));
+    assert.ok(text.includes("EmailDkimRecord1Name"));
+    assert.ok(!text.includes("ses:SendEmail"), "identity setup does not grant unsolicited sending authority");
+  },
+  existing() {
+    const template = synth({ ...base(), email: { mode: "existing", sendingDomain: "news.example.test",
+      configurationSet: "already-owned", eventTopicName: "already-owned-events" } });
+    template.resourceCountIs("AWS::SES::EmailIdentity", 0);
+    template.resourceCountIs("AWS::SES::ConfigurationSet", 0);
+    template.resourceCountIs("AWS::SNS::Topic", 0);
+    assert.ok(JSON.stringify(template.toJSON()).includes("already-owned"));
+  },
+  static() {
+    const raw: Record<string, unknown> = { ...base(), reader: { buildCommand: "make site", baseDirectory: "dist" } };
+    delete raw.cms;
+    const template = synth(raw);
+    template.resourceCountIs("AWS::SES::EmailIdentity", 0);
+    template.resourceCountIs("AWS::SES::ConfigurationSet", 0);
+    template.resourceCountIs("AWS::SES::ReceiptRule", 0);
+  },
+  missing() {
+    assert.throws(() => parseSiteConfig(base()), /email.*required.*cloud/i);
+    assert.throws(() => parseSiteConfig({ ...base(), email: { mode: "existing", sendingDomain: "news.example.test" } }), /email.configurationSet/);
+  },
+};
+export function runCloudEmailTests(selected?: string): void {
+  if (selected) { assert.ok(checks[selected], selected); checks[selected](); }
+  else for (const check of Object.values(checks)) check();
+  console.log("cloud email infrastructure: ok");
+}
+
+runCloudEmailTests(process.argv[2]);

package/infra/cloud-email.ts

@@ -0,0 +1,60 @@
+import { ArnFormat, CfnOutput, RemovalPolicy, Stack } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as ses from "aws-cdk-lib/aws-ses";
+import * as sns from "aws-cdk-lib/aws-sns";
+
+import type { CloudEmailConfig } from "./cloud-email-config";
+
+/** No DNS mutation, sending grant or receipt activation. Existing identities remain with their owner. */
+export function addCloudEmail(stack: Stack, config: CloudEmailConfig): Record<string, string> {
+  if (config.mode === "managed") {
+    const configurationSet = new ses.CfnConfigurationSet(stack, "CloudEmailConfigurationSet", {
+      name: config.configurationSet,
+      reputationOptions: { reputationMetricsEnabled: true },
+      suppressionOptions: { suppressedReasons: ["BOUNCE", "COMPLAINT"] },
+      sendingOptions: { sendingEnabled: true },
+    });
+    configurationSet.applyRemovalPolicy(RemovalPolicy.RETAIN);
+    const identity = new ses.CfnEmailIdentity(stack, "CloudEmailIdentity", {
+      emailIdentity: config.sendingDomain,
+      dkimSigningAttributes: { nextSigningKeyLength: "RSA_2048_BIT" },
+      configurationSetAttributes: { configurationSetName: configurationSet.ref },
+    });
+    identity.applyRemovalPolicy(RemovalPolicy.RETAIN);
+    const topic = new sns.Topic(stack, "CloudEmailEvents", { topicName: config.eventTopicName });
+    topic.applyRemovalPolicy(RemovalPolicy.RETAIN);
+    topic.addToResourcePolicy(new iam.PolicyStatement({
+      principals: [new iam.ServicePrincipal("ses.amazonaws.com")], actions: ["sns:Publish"],
+      resources: [topic.topicArn], conditions: { StringEquals: { "aws:SourceAccount": stack.account } },
+    }));
+    const events = new ses.CfnConfigurationSetEventDestination(stack, "CloudEmailEventDestination", {
+      configurationSetName: configurationSet.ref,
+      eventDestination: { name: "delivery-events", enabled: true,
+        matchingEventTypes: ["SEND", "DELIVERY", "BOUNCE", "COMPLAINT", "REJECT", "RENDERING_FAILURE", "DELIVERY_DELAY"],
+        snsDestination: { topicArn: topic.topicArn } },
+    });
+    events.node.addDependency(topic);
+    // These dimensions also feed the newsletter consumer's existing bounce/complaint alarms.
+    new ses.CfnConfigurationSetEventDestination(stack, "CloudEmailMetrics", {
+      configurationSetName: configurationSet.ref,
+      eventDestination: { name: "cloudwatch-metrics", enabled: true,
+        matchingEventTypes: ["SEND", "BOUNCE", "COMPLAINT"],
+        cloudWatchDestination: { dimensionConfigurations: [{ dimensionName: "ses:configuration-set",
+          dimensionValueSource: "MESSAGE_TAG", defaultDimensionValue: config.configurationSet }] } },
+    });
+    const records = [[identity.attrDkimDnsTokenName1, identity.attrDkimDnsTokenValue1],
+      [identity.attrDkimDnsTokenName2, identity.attrDkimDnsTokenValue2],
+      [identity.attrDkimDnsTokenName3, identity.attrDkimDnsTokenValue3]];
+    records.forEach(([name, value], index) => {
+      new CfnOutput(stack, `EmailDkimRecord${index + 1}Name`, { value: name, description: "CNAME name; DNS change requires separate approval" });
+      new CfnOutput(stack, `EmailDkimRecord${index + 1}Value`, { value });
+    });
+  }
+  const identityArn = stack.formatArn({ service: "ses", resource: "identity", resourceName: config.sendingDomain, arnFormat: ArnFormat.SLASH_RESOURCE_NAME });
+  new CfnOutput(stack, "EmailIdentityArn", { value: identityArn });
+  new CfnOutput(stack, "EmailConfigurationSetName", { value: config.configurationSet });
+  new CfnOutput(stack, "EmailEventTopicName", { value: config.eventTopicName });
+  return { PAPYRUS_EMAIL_FROM_ADDRESS: `${config.senderLocalPart}@${config.sendingDomain}`,
+    PAPYRUS_EMAIL_IDENTITY_ARN: identityArn, PAPYRUS_EMAIL_CONFIGURATION_SET: config.configurationSet,
+    PAPYRUS_EMAIL_EVENT_TOPIC_NAME: config.eventTopicName };
+}

package/infra/index.js

@@ -10,6 +10,7 @@ try {
   );
 }
 export const { AmplifyAppShellStack } = await import("./amplify-app-shell.js");
+export const { SecureStringParameter } = await import("./secure-string-parameter.js");
 export const { GithubOidcProviderStack } = await import("./github-oidc-provider.js");
 export { parseSiteConfig } from "./site-config.js";
 export { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec, buildSpecFor } from "./build-specs.js";

package/infra/secure-string-parameter-handler.js

@@ -0,0 +1,41 @@
+/**
+ * Source of the Lambda behind SecureStringParameter, as a string so the staged
+ * package (which ships only .ts under infra/) can inline it and tests can run it
+ * against a fake SSM client. CommonJS, under the 4096-character inline limit.
+ *
+ * It creates the parameter when it is missing and does nothing else: it never
+ * overwrites an existing value, never reads one back, never logs the value, and
+ * returns no data (only the parameter name as the physical id).
+ */
+export const SECURE_STRING_PARAMETER_HANDLER_SOURCE = `
+const { randomInt } = require("node:crypto");
+const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+function generate(length) {
+  let value = "";
+  for (let index = 0; index < length; index += 1) value += ALPHABET[randomInt(ALPHABET.length)];
+  return value;
+}
+exports.createHandler = (ssm, PutParameterCommand) => async (event) => {
+  const name = event.ResourceProperties.ParameterName;
+  if (event.RequestType === "Delete") return { PhysicalResourceId: event.PhysicalResourceId };
+  try {
+    await ssm.send(new PutParameterCommand({
+      Name: name,
+      Description: event.ResourceProperties.Description,
+      Type: "SecureString",
+      Tier: "Standard",
+      Overwrite: false,
+      Value: generate(Number(event.ResourceProperties.Length)),
+    }));
+  } catch (error) {
+    if (!error || error.name !== "ParameterAlreadyExists") {
+      throw new Error("PutParameter failed for " + name + " (" + (error && error.name ? error.name : "error") + ")");
+    }
+  }
+  return { PhysicalResourceId: name };
+};
+exports.handler = async (event) => {
+  const { SSMClient, PutParameterCommand } = require("@aws-sdk/client-ssm");
+  return exports.createHandler(new SSMClient({}), PutParameterCommand)(event);
+};
+`;

package/infra/secure-string-parameter-handler.ts

@@ -0,0 +1,41 @@
+/**
+ * Source of the Lambda behind SecureStringParameter, as a string so the staged
+ * package (which ships only .ts under infra/) can inline it and tests can run it
+ * against a fake SSM client. CommonJS, under the 4096-character inline limit.
+ *
+ * It creates the parameter when it is missing and does nothing else: it never
+ * overwrites an existing value, never reads one back, never logs the value, and
+ * returns no data (only the parameter name as the physical id).
+ */
+export const SECURE_STRING_PARAMETER_HANDLER_SOURCE = `
+const { randomInt } = require("node:crypto");
+const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+function generate(length) {
+  let value = "";
+  for (let index = 0; index < length; index += 1) value += ALPHABET[randomInt(ALPHABET.length)];
+  return value;
+}
+exports.createHandler = (ssm, PutParameterCommand) => async (event) => {
+  const name = event.ResourceProperties.ParameterName;
+  if (event.RequestType === "Delete") return { PhysicalResourceId: event.PhysicalResourceId };
+  try {
+    await ssm.send(new PutParameterCommand({
+      Name: name,
+      Description: event.ResourceProperties.Description,
+      Type: "SecureString",
+      Tier: "Standard",
+      Overwrite: false,
+      Value: generate(Number(event.ResourceProperties.Length)),
+    }));
+  } catch (error) {
+    if (!error || error.name !== "ParameterAlreadyExists") {
+      throw new Error("PutParameter failed for " + name + " (" + (error && error.name ? error.name : "error") + ")");
+    }
+  }
+  return { PhysicalResourceId: name };
+};
+exports.handler = async (event) => {
+  const { SSMClient, PutParameterCommand } = require("@aws-sdk/client-ssm");
+  return exports.createHandler(new SSMClient({}), PutParameterCommand)(event);
+};
+`;

package/infra/secure-string-parameter.js

@@ -0,0 +1,79 @@
+import { Construct } from "constructs";
+import { ArnFormat, CustomResource, Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import * as customResources from "aws-cdk-lib/custom-resources";
+import { SECURE_STRING_PARAMETER_HANDLER_SOURCE } from "./secure-string-parameter-handler.js";
+/** One Lambda and role per stack, shared by every SecureStringParameter in it. */
+class SecureStringParameterProvider extends Construct {
+    static ID = "SecureStringParameterProvider";
+    role;
+    provider;
+    static of(stack) {
+        return stack.node.tryFindChild(SecureStringParameterProvider.ID)
+            ?? new SecureStringParameterProvider(stack);
+    }
+    constructor(stack) {
+        super(stack, SecureStringParameterProvider.ID);
+        this.role = new iam.Role(this, "Role", {
+            assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
+            description: "Creates generated SecureString parameters: PutParameter per named parameter, never overwriting",
+            managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")],
+        });
+        const onEvent = new lambda.Function(this, "OnEvent", {
+            runtime: lambda.Runtime.NODEJS_22_X,
+            handler: "index.handler",
+            code: lambda.Code.fromInline(SECURE_STRING_PARAMETER_HANDLER_SOURCE),
+            role: this.role,
+            timeout: Duration.seconds(30),
+            description: "Creates a generated SecureString parameter once; never returns or logs the value",
+        });
+        this.provider = new customResources.Provider(this, "Provider", { onEventHandler: onEvent });
+    }
+}
+/**
+ * A generated secret in SSM Parameter Store as a standard SecureString (free,
+ * AWS-managed `aws/ssm` key), instead of a Secrets Manager secret ($0.40/month).
+ *
+ * CloudFormation cannot create a SecureString, so a custom resource Lambda puts
+ * it. The Lambda generates a random value at create time and never returns or
+ * logs it, so the value is in no template, output or stack event. It is
+ * create-only: an update never regenerates it and never overwrites a parameter
+ * that already exists (a hand-made one is adopted as it is), and delete retains
+ * it, so a stack teardown cannot sign anyone out. Rotate it with
+ * `aws ssm put-parameter --overwrite`. Readers get `ssm:GetParameter` on
+ * `parameterArn` only; decrypting with the AWS-managed key needs no KMS grant.
+ */
+export class SecureStringParameter extends Construct {
+    parameterName;
+    parameterArn;
+    constructor(scope, id, props) {
+        super(scope, id);
+        if (!props.parameterName.startsWith("/"))
+            throw new Error(`SSM parameter name must be absolute: ${props.parameterName}`);
+        const length = props.length ?? 64;
+        if (!Number.isInteger(length) || length < 32)
+            throw new Error("A generated secret must be at least 32 characters.");
+        const stack = Stack.of(this);
+        this.parameterName = props.parameterName;
+        this.parameterArn = stack.formatArn({
+            service: "ssm",
+            resource: "parameter",
+            resourceName: props.parameterName.slice(1),
+            arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+        });
+        const shared = SecureStringParameterProvider.of(stack);
+        shared.role.addToPolicy(new iam.PolicyStatement({
+            sid: `Put${id.replace(/[^A-Za-z0-9]/g, "")}`,
+            actions: ["ssm:PutParameter"],
+            resources: [this.parameterArn],
+        }));
+        const resource = new CustomResource(this, "Resource", {
+            serviceToken: shared.provider.serviceToken,
+            resourceType: "Custom::SecureStringParameter",
+            properties: { ParameterName: props.parameterName, Description: props.description, Length: String(length) },
+            removalPolicy: RemovalPolicy.RETAIN,
+        });
+        resource.node.addDependency(shared.role);
+    }
+}

package/infra/secure-string-parameter.ts

@@ -0,0 +1,91 @@
+import { Construct } from "constructs";
+import { ArnFormat, CustomResource, Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import * as customResources from "aws-cdk-lib/custom-resources";
+import { SECURE_STRING_PARAMETER_HANDLER_SOURCE } from "./secure-string-parameter-handler";
+
+export interface SecureStringParameterProps {
+  /** Absolute parameter name, e.g. `/papyrus/<siteId>/prospectus-session-sealing`. */
+  parameterName: string;
+  description: string;
+  /** Length of the generated value. Default 64. */
+  length?: number;
+}
+
+/** One Lambda and role per stack, shared by every SecureStringParameter in it. */
+class SecureStringParameterProvider extends Construct {
+  static readonly ID = "SecureStringParameterProvider";
+  public readonly role: iam.Role;
+  public readonly provider: customResources.Provider;
+
+  static of(stack: Stack): SecureStringParameterProvider {
+    return (stack.node.tryFindChild(SecureStringParameterProvider.ID) as SecureStringParameterProvider | undefined)
+      ?? new SecureStringParameterProvider(stack);
+  }
+
+  private constructor(stack: Stack) {
+    super(stack, SecureStringParameterProvider.ID);
+    this.role = new iam.Role(this, "Role", {
+      assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
+      description: "Creates generated SecureString parameters: PutParameter per named parameter, never overwriting",
+      managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")],
+    });
+    const onEvent = new lambda.Function(this, "OnEvent", {
+      runtime: lambda.Runtime.NODEJS_22_X,
+      handler: "index.handler",
+      code: lambda.Code.fromInline(SECURE_STRING_PARAMETER_HANDLER_SOURCE),
+      role: this.role,
+      timeout: Duration.seconds(30),
+      description: "Creates a generated SecureString parameter once; never returns or logs the value",
+    });
+    this.provider = new customResources.Provider(this, "Provider", { onEventHandler: onEvent });
+  }
+}
+
+/**
+ * A generated secret in SSM Parameter Store as a standard SecureString (free,
+ * AWS-managed `aws/ssm` key), instead of a Secrets Manager secret ($0.40/month).
+ *
+ * CloudFormation cannot create a SecureString, so a custom resource Lambda puts
+ * it. The Lambda generates a random value at create time and never returns or
+ * logs it, so the value is in no template, output or stack event. It is
+ * create-only: an update never regenerates it and never overwrites a parameter
+ * that already exists (a hand-made one is adopted as it is), and delete retains
+ * it, so a stack teardown cannot sign anyone out. Rotate it with
+ * `aws ssm put-parameter --overwrite`. Readers get `ssm:GetParameter` on
+ * `parameterArn` only; decrypting with the AWS-managed key needs no KMS grant.
+ */
+export class SecureStringParameter extends Construct {
+  public readonly parameterName: string;
+  public readonly parameterArn: string;
+
+  constructor(scope: Construct, id: string, props: SecureStringParameterProps) {
+    super(scope, id);
+    if (!props.parameterName.startsWith("/")) throw new Error(`SSM parameter name must be absolute: ${props.parameterName}`);
+    const length = props.length ?? 64;
+    if (!Number.isInteger(length) || length < 32) throw new Error("A generated secret must be at least 32 characters.");
+    const stack = Stack.of(this);
+    this.parameterName = props.parameterName;
+    this.parameterArn = stack.formatArn({
+      service: "ssm",
+      resource: "parameter",
+      resourceName: props.parameterName.slice(1),
+      arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+    });
+
+    const shared = SecureStringParameterProvider.of(stack);
+    shared.role.addToPolicy(new iam.PolicyStatement({
+      sid: `Put${id.replace(/[^A-Za-z0-9]/g, "")}`,
+      actions: ["ssm:PutParameter"],
+      resources: [this.parameterArn],
+    }));
+    const resource = new CustomResource(this, "Resource", {
+      serviceToken: shared.provider.serviceToken,
+      resourceType: "Custom::SecureStringParameter",
+      properties: { ParameterName: props.parameterName, Description: props.description, Length: String(length) },
+      removalPolicy: RemovalPolicy.RETAIN,
+    });
+    resource.node.addDependency(shared.role);
+  }
+}