@ashishpandeyone/cdk-lambda-web-function 0.1.4 → 0.1.6

package/README.md

@@ -16,7 +16,7 @@
 
 <!--END STABILITY BANNER-->
 
-[AWS Lambda Web Functions](https://aws.amazon.com/lambda/) run an ordinary Node.js HTTP server (Express, Fastify, Hono, `node:http`) on Lambda and give it an HTTPS endpoint, optionally served from several regions. `WebFunction` deploys one, following the conventions of `aws-cdk-lib/aws-lambda` where the two services overlap.
+[AWS Lambda Web Functions](https://docs.aws.amazon.com/lambda/latest/dg/web-functions.html) run an ordinary Node.js HTTP server (Express, Fastify, Hono, `node:http`) on Lambda and give it an HTTPS endpoint, optionally served from several regions. `WebFunction` deploys one, following the conventions of `aws-cdk-lib/aws-lambda` where the two services overlap.
 
 ```ts fixture=bare
 import * as lambda from 'aws-cdk-lib/aws-lambda';
@@ -37,10 +37,18 @@ new CfnOutput(this, 'Url', { value: fn.endpoint.url }); // https://<id>.lambda-w
 
 The stack's region is the function's **home region**. Multi-region endpoints need a stack with an explicit `env.region`.
 
+## Installation
+
+```bash
+npm install @ashishpandeyone/cdk-lambda-web-function
+```
+
+It needs `aws-cdk-lib` 2.273.0 or later and `constructs` 10.5.1 or later (peer dependencies), and Node.js 22 or later. The package is published for TypeScript and JavaScript only.
+
 ## Writing the server
 
 1. Listen on the host and port in **`AWS_LAMBDA_HTTP_ENDPOINT`** (`0.0.0.0:3000` today). `PORT` is not set.
-2. Start listening within **about 9 seconds**, or initialisation fails with `Application.TimeoutListenError`.
+2. Start listening within **10 seconds**, or initialisation fails with `Application.TimeoutListenError`.
 3. Put the entry file at the root of your bundle as **`index.js`**, or set `entrypoint`.
 4. The runtime has **no AWS SDK**: bundle the clients you import.
 5. Code runs on **arm64**.
@@ -148,6 +156,7 @@ import { SignatureV4a } from '@smithy/signature-v4a';
 import { Sha256 } from '@aws-crypto/sha256-js';
 import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
 
+const host = new URL(url).hostname; // url: the endpoint's URL
 const signer = new SignatureV4a({ service: 'lambda', region: '*', sha256: Sha256, credentials: fromNodeProviderChain() });
 const signed = await signer.sign(
   { method: 'GET', protocol: 'https:', hostname: host, path: '/', headers: { host } },
@@ -156,6 +165,71 @@ const signed = await signer.sign(
 const response = await fetch(`https://${host}/`, { headers: signed.headers });
 ```
 
+### Other accounts and AWS services
+
+A caller in another account needs permission twice: in its own IAM policy, and in the function's **resource policy**. `grantInvoke` handles the function's side: a role in the function's account only gets an IAM policy statement, while a principal in another account or an AWS service also gets a statement in the resource policy.
+
+```ts
+fn.grantInvoke(iam.Role.fromRoleArn(this, 'Partner', 'arn:aws:iam::444455556666:role/caller'));
+```
+
+For principals you can't grant to (a whole account, an organization, an AWS service with conditions), use `addPermission`. The `id` becomes the statement's `Sid`:
+
+```ts
+fn.addPermission('PartnerAccount', { principal: new iam.AccountPrincipal('444455556666') });
+fn.addPermission('MyOrg', { principal: new iam.OrganizationPrincipal('o-a1b2c3d4e5'), endpoint: fn.endpoint });
+fn.addPermission('Cdn', {
+  principal: new iam.ServicePrincipal('cloudfront.amazonaws.com'),
+  sourceArn: `arn:aws:cloudfront::${this.account}:distribution/EDFDVBD6EXAMPLE`,
+});
+```
+
+`addPermission` allows calling every endpoint unless you pass `endpoint`. For other actions, such as letting another account create revisions, use `fn.addToResourcePolicy(statement)`. Statements use the endpoint ARN for invoking and the function ARN for actions on the function.
+
+- **One resource policy per function, written by the function's stack.** The construct creates it (`AWS::Lambda::ResourcePolicy`) with the first statement. CloudFormation can't attach a second one: another stack, or a `CfnResourcePolicy` of your own on the function, fails at change-set validation with "already exists". If you attached one yourself, move its statements into `addPermission` or `addToResourcePolicy`. Each update of the policy replaces any statements added outside CloudFormation.
+- **Public policies are rejected.** Lambda refuses a policy that lets anyone call the function, and the construct fails synthesis first. A `*` principal is only accepted with a condition that pins the caller, such as `aws:PrincipalOrgID` (`iam.OrganizationPrincipal`) or `aws:SourceAccount`. For a public endpoint, use `authType: NONE`.
+- **Scope AWS services to your resource.** Lambda accepts a service principal with no condition, which would let that service call the endpoint on behalf of any account. The construct warns unless you give `sourceArn` or `sourceAccount` (or an `aws:SourceArn`, `aws:SourceAccount`, `aws:SourceOrgID` or `aws:SourceOrgPaths` condition).
+- Lambda copies the policy to every region the function's endpoints serve from. The copy is eventually consistent, and in tests changes applied in every region within seconds.
+
+### CloudFront
+
+Put a CloudFront distribution (`aws-cdk-lib/aws-cloudfront`) in front of an `AWS_IAM` endpoint to serve the public with a custom domain, caching and AWS WAF. Viewers don't sign anything, and only your distribution may call the endpoint:
+
+```ts
+new cloudfront.Distribution(this, 'Cdn', {
+  defaultBehavior: {
+    origin: WebFunctionOrigin.withOriginAccessControl(fn.endpoint),
+    viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+    allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
+    cachePolicy: cloudfront.CachePolicy.CACHING_DISABLED,
+    originRequestPolicy: cloudfront.OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
+  },
+});
+```
+
+`withOriginAccessControl` adds:
+- an origin access control (origin type `lambda`, signing behavior `always-amz-auth`, the only one CloudFront accepts for Web Function origins), one per stack and signing protocol: SigV4 for a regional domain, SigV4a for a `MULTI_REGION` endpoint's global domain;
+- a statement in the function's resource policy that allows `cloudfront.amazonaws.com` to call this endpoint on behalf of this distribution only (`aws:SourceArn`).
+
+Some things to know:
+- **Forward everything except `Host`.** The endpoint answers 404 when `Host` is the distribution's domain, so use `ALL_VIEWER_EXCEPT_HOST_HEADER` (not `ALL_VIEWER`), or a policy of your own without `Host`.
+- **Your application can still authenticate viewers.** CloudFront signs in its own headers and passes the viewer's `Authorization` header (a JWT, for example) through unchanged, but only when `Authorization` is in the cache policy. CloudFront drops it from `GET` and `HEAD` requests otherwise:
+
+  ```ts
+  const forwardAuthorization = new cloudfront.CachePolicy(this, 'ForwardAuthorization', {
+    headerBehavior: cloudfront.CacheHeaderBehavior.allowList('Authorization'),
+    minTtl: Duration.seconds(0),
+    defaultTtl: Duration.seconds(0),
+    maxTtl: Duration.seconds(1), // a cache key with headers needs caching enabled; 0/0/1 keeps it off in practice
+  });
+  ```
+- Request bodies work without clients sending `x-amz-content-sha256`: CloudFront signs `POST`, `PUT` and `PATCH` requests with an unsigned payload.
+- A `PER_REGION` endpoint's origin calls one region: the home region, or the one you pass as `region`. Use one origin per region, for example in an origin group.
+- A `MULTI_REGION` endpoint can't include opt-in regions (such as `me-central-1`), because CloudFront can't sign for them. The construct fails synthesis.
+- The distribution must be in the function's stack. Lambda@Edge origin-request and origin-response triggers aren't supported on behaviors with this origin.
+- The endpoint stays reachable at its own domain for signed requests your policies allow. Until a new distribution finishes deploying, requests through it can get a transient 403.
+- `new WebFunctionOrigin(endpoint)` is for a public (`NONE`) endpoint, for example behind AWS WAF. Lambda doesn't authenticate those requests, so the endpoint's own domain stays public too.
+
 ### Functions defined elsewhere
 
 Import a Web Function defined in another stack or app to grant access to it, read its metrics, or reference its revisions:
@@ -173,7 +247,7 @@ live.metricConcurrentRequests().createAlarm(this, 'Busy', { threshold: 60, evalu
 
 An imported function's metrics default to its own region. Its endpoints, revisions and log groups stay with the stack that defines it.
 
-`grantInvoke` adds to the caller's IAM policy, which is all a caller in the function's account needs. A caller in another account also needs the function's resource policy to allow it, which this library doesn't manage yet.
+An imported function's `grantInvoke` adds to the caller's IAM policy only, which is all a caller in the function's account needs. A caller in another account also needs the function's resource policy to allow it, which only the function's own stack can change: `addToResourcePolicy` on an imported function adds nothing and warns.
 
 ## Configuration
 
@@ -194,6 +268,7 @@ api.addEnvironment('FEATURE_FLAG', 'on');
 table.grantReadWriteData(api);           // the default role trusts lambda.amazonaws.com
 ```
 
+- **Each execution environment has 2 vCPUs and 2 GB of memory.** There's no memory setting as on Lambda functions; scale with `maxConcurrencyPerEnvironment` and more environments instead.
 - Requests handled by one environment share module-level state, so keep handlers concurrency-safe.
 - Environment variable names starting with `AWS_` are reserved.
 - **Renaming the function replaces it and changes its URL.** A generated name depends on the construct path, so moving the construct renames it too.
@@ -228,7 +303,7 @@ new NodejsWebFunction(this, 'Api', {
 
 Lambda Web Functions download code as the `lambda.amazonaws.com` service principal, from a **versioned** bucket, and the CDK bootstrap bucket allows neither. So each stack gets a small code bucket, and the code is copied into it on deploy. The bucket is emptied and deleted with the stack.
 
-Code copies, log groups in other regions, revision cleanup and the bucket's emptying run in one custom resource Lambda per stack. Its logs go to a log group the stack owns, kept for a month and deleted with the stack.
+Copying code, managing the function's log groups in every region, looking up regional URLs, cleaning up old revisions, creating rollback alarms in other regions and emptying the code bucket all run in one custom resource Lambda per stack. Its logs go to a log group the stack owns, kept for a month and deleted with the stack.
 
 ## Revisions
 
@@ -364,7 +439,7 @@ Web Functions log in two tiers:
  └──────────────────┘              └──────────────────────────────────────────┘
 ```
 
-**Query `fn.logGroup`**, the home-region group that receives every region's logs. The service would create missing groups without retention and never delete them, so the construct creates and owns all of them: both home-region groups, and `<group>.local` in every other region of the endpoint.
+**Query `fn.logGroup`**, the home-region group that receives every region's logs. The service would create missing groups without retention and never delete them, so the construct creates and owns all of them: both home-region groups, and `<group>.local` in every other region any of its endpoints serves from.
 
 ```ts
 new WebFunction(this, 'Api', {
@@ -385,8 +460,9 @@ new WebFunction(this, 'Api', {
 
 ## Limitations
 
-- Not yet supported: VPC access (network connectors), resource-policy permissions, KMS encryption, tracing, and a CloudFront origin.
-- `cdk deploy --hotswap` and `cdk watch` don't support Web Functions.
+- Not yet supported: VPC access (network connectors), KMS encryption, and tracing.
+- **Hotswap skips Web Functions without a warning.** `cdk deploy --hotswap` and `cdk watch`, which hotswaps by default, report `(no changes)` for a code or configuration change and the endpoint keeps serving the old revision. Use `cdk watch --hotswap-fallback` (or `cdk deploy --hotswap-fallback`): it deploys Web Function changes through CloudFormation, in about 40 seconds for a home-region endpoint.
+- Fixed limits: 512 MB of code (unzipped) and 32 KB of environment variables per revision, 512 MB of `/tmp` per execution environment, and 128 KiB of headers per request.
 - Quotas: 10 endpoints and about 50 revisions per function (Lambda cleans up older revisions automatically), and 10,000 requests per second per endpoint. Per account and region: 100,000 requests per second and 2,000 Arm64 vCPUs (each execution environment uses 2). The account quotas are adjustable, and new accounts start lower. See [Lambda quotas](https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-limits.html).
 
 ## Development

package/lib/index.d.ts

@@ -1,6 +1,7 @@
 export * from './enums';
 export * from './web-function';
 export * from './web-function-endpoint';
+export * from './web-function-origin';
 export * from './web-function-grants';
 export * from './nodejs-web-function';
 export * from './web-function-revision';

package/lib/index.js

@@ -17,8 +17,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./enums"), exports);
 __exportStar(require("./web-function"), exports);
 __exportStar(require("./web-function-endpoint"), exports);
+__exportStar(require("./web-function-origin"), exports);
 __exportStar(require("./web-function-grants"), exports);
 __exportStar(require("./nodejs-web-function"), exports);
 __exportStar(require("./web-function-revision"), exports);
 __exportStar(require("./web-function-deployment"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLDBDQUF3QjtBQUN4QixpREFBK0I7QUFDL0IsMERBQXdDO0FBQ3hDLHdEQUFzQztBQUN0Qyx3REFBc0M7QUFDdEMsMERBQXdDO0FBQ3hDLDREQUEwQyIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCAqIGZyb20gJy4vZW51bXMnO1xuZXhwb3J0ICogZnJvbSAnLi93ZWItZnVuY3Rpb24nO1xuZXhwb3J0ICogZnJvbSAnLi93ZWItZnVuY3Rpb24tZW5kcG9pbnQnO1xuZXhwb3J0ICogZnJvbSAnLi93ZWItZnVuY3Rpb24tZ3JhbnRzJztcbmV4cG9ydCAqIGZyb20gJy4vbm9kZWpzLXdlYi1mdW5jdGlvbic7XG5leHBvcnQgKiBmcm9tICcuL3dlYi1mdW5jdGlvbi1yZXZpc2lvbic7XG5leHBvcnQgKiBmcm9tICcuL3dlYi1mdW5jdGlvbi1kZXBsb3ltZW50JztcbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLDBDQUF3QjtBQUN4QixpREFBK0I7QUFDL0IsMERBQXdDO0FBQ3hDLHdEQUFzQztBQUN0Qyx3REFBc0M7QUFDdEMsd0RBQXNDO0FBQ3RDLDBEQUF3QztBQUN4Qyw0REFBMEMiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgKiBmcm9tICcuL2VudW1zJztcbmV4cG9ydCAqIGZyb20gJy4vd2ViLWZ1bmN0aW9uJztcbmV4cG9ydCAqIGZyb20gJy4vd2ViLWZ1bmN0aW9uLWVuZHBvaW50JztcbmV4cG9ydCAqIGZyb20gJy4vd2ViLWZ1bmN0aW9uLW9yaWdpbic7XG5leHBvcnQgKiBmcm9tICcuL3dlYi1mdW5jdGlvbi1ncmFudHMnO1xuZXhwb3J0ICogZnJvbSAnLi9ub2RlanMtd2ViLWZ1bmN0aW9uJztcbmV4cG9ydCAqIGZyb20gJy4vd2ViLWZ1bmN0aW9uLXJldmlzaW9uJztcbmV4cG9ydCAqIGZyb20gJy4vd2ViLWZ1bmN0aW9uLWRlcGxveW1lbnQnO1xuIl19

package/lib/nodejs-web-function.js

@@ -49,7 +49,7 @@ const web_function_1 = require("./web-function");
  * bundle, and `NODE_OPTIONS=--enable-source-maps` when source maps are on.
  */
 class NodejsWebFunction extends web_function_1.WebFunction {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction", version: "0.1.4" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction", version: "0.1.6" };
     constructor(scope, id, props) {
         const runtime = props.runtime ?? lambda.Runtime.NODEJS_24_X;
         const entry = (0, bundling_1.resolveEntry)(props.entry);

package/lib/private/resource-policy.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Checks on a Web Function's resource policy, run at synthesis on the resolved document.
+ *
+ * Lambda rejects a public policy at deploy time ("Lambda blocked the creation of this policy because it would grant
+ * public access"): a `*` principal is only accepted when a trusted condition key pins the caller. A service principal
+ * without a source condition is accepted, but lets any account's use of that service call the endpoint.
+ */
+export interface ResourcePolicyFindings {
+    /** Statements Lambda would reject as public. */
+    readonly errors: string[];
+    /** Service principals allowed without a source condition. */
+    readonly unscopedServices: string[];
+}
+/** Inspects a resolved policy document (`{ Statement: [...] }`). */
+export declare function inspectResourcePolicy(document: any): ResourcePolicyFindings;

package/lib/private/resource-policy.js

@@ -0,0 +1,48 @@
+"use strict";
+/**
+ * Checks on a Web Function's resource policy, run at synthesis on the resolved document.
+ *
+ * Lambda rejects a public policy at deploy time ("Lambda blocked the creation of this policy because it would grant
+ * public access"): a `*` principal is only accepted when a trusted condition key pins the caller. A service principal
+ * without a source condition is accepted, but lets any account's use of that service call the endpoint.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectResourcePolicy = inspectResourcePolicy;
+/** Condition keys Lambda accepts to make a `*` principal non-public (Lambda Web Function permissions docs, 2026-10). */
+const TRUSTED_KEYS = [
+    'aws:PrincipalAccount', 'aws:PrincipalArn', 'aws:PrincipalOrgID', 'aws:PrincipalOrgPaths', 'aws:SourceAccount', 'aws:SourceArn',
+    'aws:SourceOrgID', 'aws:SourceOrgPaths', 'aws:SourceVpc', 'aws:SourceVpcArn', 'aws:SourceVpce', 'aws:VpceAccount', 'aws:VpceOrgID',
+    'aws:VpceOrgPaths', 'aws:Ec2InstanceSourceVpc', 'aws:UserId', 'aws:PrincipalServiceName', 'aws:PrincipalServiceNamesList',
+    'aws:PrincipalIsAWSService', 'lambda:SourceFunctionArn',
+].map((k) => k.toLowerCase());
+/** Condition keys that tie a service principal to the resource or account calling on its behalf. */
+const SOURCE_KEYS = ['aws:SourceArn', 'aws:SourceAccount', 'aws:SourceOrgID', 'aws:SourceOrgPaths'].map((k) => k.toLowerCase());
+/** Inspects a resolved policy document (`{ Statement: [...] }`). */
+function inspectResourcePolicy(document) {
+    const errors = [];
+    const unscopedServices = [];
+    for (const [i, s] of (document?.Statement ?? []).entries()) {
+        if (s.Effect !== 'Allow')
+            continue;
+        const keys = conditionKeys(s.Condition);
+        const name = s.Sid ? `statement '${s.Sid}'` : `statement ${i + 1}`;
+        if (isWildcard(s.Principal) && !keys.some((k) => TRUSTED_KEYS.includes(k))) {
+            errors.push(`${name} allows principal '*': Lambda rejects public resource policies. Pin the caller with a condition such as aws:PrincipalOrgID or aws:SourceAccount (e.g. iam.OrganizationPrincipal), or name the accounts`);
+        }
+        const services = list(s.Principal?.Service).map(String);
+        if (services.length > 0 && !keys.some((k) => SOURCE_KEYS.includes(k))) {
+            unscopedServices.push(...services);
+        }
+    }
+    return { errors, unscopedServices };
+}
+function isWildcard(principal) {
+    return principal === '*' || list(principal?.AWS).includes('*');
+}
+function conditionKeys(condition) {
+    return Object.values(condition ?? {}).flatMap((byKey) => Object.keys(byKey ?? {})).map((k) => k.toLowerCase());
+}
+function list(value) {
+    return value === undefined ? [] : Array.isArray(value) ? value : [value];
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVzb3VyY2UtcG9saWN5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3ByaXZhdGUvcmVzb3VyY2UtcG9saWN5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUFBQTs7Ozs7O0dBTUc7O0FBcUJILHNEQWdCQztBQW5DRCx3SEFBd0g7QUFDeEgsTUFBTSxZQUFZLEdBQUc7SUFDbkIsc0JBQXNCLEVBQUUsa0JBQWtCLEVBQUUsb0JBQW9CLEVBQUUsdUJBQXVCLEVBQUUsbUJBQW1CLEVBQUUsZUFBZTtJQUMvSCxpQkFBaUIsRUFBRSxvQkFBb0IsRUFBRSxlQUFlLEVBQUUsa0JBQWtCLEVBQUUsZ0JBQWdCLEVBQUUsaUJBQWlCLEVBQUUsZUFBZTtJQUNsSSxrQkFBa0IsRUFBRSwwQkFBMEIsRUFBRSxZQUFZLEVBQUUsMEJBQTBCLEVBQUUsK0JBQStCO0lBQ3pILDJCQUEyQixFQUFFLDBCQUEwQjtDQUN4RCxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUM7QUFFOUIsb0dBQW9HO0FBQ3BHLE1BQU0sV0FBVyxHQUFHLENBQUMsZUFBZSxFQUFFLG1CQUFtQixFQUFFLGlCQUFpQixFQUFFLG9CQUFvQixDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQztBQVNoSSxvRUFBb0U7QUFDcEUsU0FBZ0IscUJBQXFCLENBQUMsUUFBYTtJQUNqRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsTUFBTSxnQkFBZ0IsR0FBYSxFQUFFLENBQUM7SUFDdEMsS0FBSyxNQUFNLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLFNBQVMsSUFBSSxFQUFFLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQzNELElBQUksQ0FBQyxDQUFDLE1BQU0sS0FBSyxPQUFPO1lBQUUsU0FBUztRQUNuQyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3hDLE1BQU0sSUFBSSxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLGNBQWMsQ0FBQyxDQUFDLEdBQUcsR0FBRyxDQUFDLENBQUMsQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNuRSxJQUFJLFVBQVUsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBSSx3TUFBd00sQ0FBQyxDQUFDO1FBQy9OLENBQUM7UUFDRCxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDLFNBQVMsRUFBRSxPQUFPLENBQUMsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDeEQsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ3RFLGdCQUFnQixDQUFDLElBQUksQ0FBQyxHQUFHLFFBQVEsQ0FBQyxDQUFDO1FBQ3JDLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxFQUFFLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxDQUFDO0FBQ3RDLENBQUM7QUFFRCxTQUFTLFVBQVUsQ0FBQyxTQUFjO0lBQ2hDLE9BQU8sU0FBUyxLQUFLLEdBQUcsSUFBSSxJQUFJLENBQUMsU0FBUyxFQUFFLEdBQUcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztBQUNqRSxDQUFDO0FBRUQsU0FBUyxhQUFhLENBQUMsU0FBYztJQUNuQyxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxJQUFJLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLEtBQVUsRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDO0FBQ3RILENBQUM7QUFFRCxTQUFTLElBQUksQ0FBQyxLQUFjO0lBQzFCLE9BQU8sS0FBSyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDM0UsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogQ2hlY2tzIG9uIGEgV2ViIEZ1bmN0aW9uJ3MgcmVzb3VyY2UgcG9saWN5LCBydW4gYXQgc3ludGhlc2lzIG9uIHRoZSByZXNvbHZlZCBkb2N1bWVudC5cbiAqXG4gKiBMYW1iZGEgcmVqZWN0cyBhIHB1YmxpYyBwb2xpY3kgYXQgZGVwbG95IHRpbWUgKFwiTGFtYmRhIGJsb2NrZWQgdGhlIGNyZWF0aW9uIG9mIHRoaXMgcG9saWN5IGJlY2F1c2UgaXQgd291bGQgZ3JhbnRcbiAqIHB1YmxpYyBhY2Nlc3NcIik6IGEgYCpgIHByaW5jaXBhbCBpcyBvbmx5IGFjY2VwdGVkIHdoZW4gYSB0cnVzdGVkIGNvbmRpdGlvbiBrZXkgcGlucyB0aGUgY2FsbGVyLiBBIHNlcnZpY2UgcHJpbmNpcGFsXG4gKiB3aXRob3V0IGEgc291cmNlIGNvbmRpdGlvbiBpcyBhY2NlcHRlZCwgYnV0IGxldHMgYW55IGFjY291bnQncyB1c2Ugb2YgdGhhdCBzZXJ2aWNlIGNhbGwgdGhlIGVuZHBvaW50LlxuICovXG5cbi8qKiBDb25kaXRpb24ga2V5cyBMYW1iZGEgYWNjZXB0cyB0byBtYWtlIGEgYCpgIHByaW5jaXBhbCBub24tcHVibGljIChMYW1iZGEgV2ViIEZ1bmN0aW9uIHBlcm1pc3Npb25zIGRvY3MsIDIwMjYtMTApLiAqL1xuY29uc3QgVFJVU1RFRF9LRVlTID0gW1xuICAnYXdzOlByaW5jaXBhbEFjY291bnQnLCAnYXdzOlByaW5jaXBhbEFybicsICdhd3M6UHJpbmNpcGFsT3JnSUQnLCAnYXdzOlByaW5jaXBhbE9yZ1BhdGhzJywgJ2F3czpTb3VyY2VBY2NvdW50JywgJ2F3czpTb3VyY2VBcm4nLFxuICAnYXdzOlNvdXJjZU9yZ0lEJywgJ2F3czpTb3VyY2VPcmdQYXRocycsICdhd3M6U291cmNlVnBjJywgJ2F3czpTb3VyY2VWcGNBcm4nLCAnYXdzOlNvdXJjZVZwY2UnLCAnYXdzOlZwY2VBY2NvdW50JywgJ2F3czpWcGNlT3JnSUQnLFxuICAnYXdzOlZwY2VPcmdQYXRocycsICdhd3M6RWMySW5zdGFuY2VTb3VyY2VWcGMnLCAnYXdzOlVzZXJJZCcsICdhd3M6UHJpbmNpcGFsU2VydmljZU5hbWUnLCAnYXdzOlByaW5jaXBhbFNlcnZpY2VOYW1lc0xpc3QnLFxuICAnYXdzOlByaW5jaXBhbElzQVdTU2VydmljZScsICdsYW1iZGE6U291cmNlRnVuY3Rpb25Bcm4nLFxuXS5tYXAoKGspID0+IGsudG9Mb3dlckNhc2UoKSk7XG5cbi8qKiBDb25kaXRpb24ga2V5cyB0aGF0IHRpZSBhIHNlcnZpY2UgcHJpbmNpcGFsIHRvIHRoZSByZXNvdXJjZSBvciBhY2NvdW50IGNhbGxpbmcgb24gaXRzIGJlaGFsZi4gKi9cbmNvbnN0IFNPVVJDRV9LRVlTID0gWydhd3M6U291cmNlQXJuJywgJ2F3czpTb3VyY2VBY2NvdW50JywgJ2F3czpTb3VyY2VPcmdJRCcsICdhd3M6U291cmNlT3JnUGF0aHMnXS5tYXAoKGspID0+IGsudG9Mb3dlckNhc2UoKSk7XG5cbmV4cG9ydCBpbnRlcmZhY2UgUmVzb3VyY2VQb2xpY3lGaW5kaW5ncyB7XG4gIC8qKiBTdGF0ZW1lbnRzIExhbWJkYSB3b3VsZCByZWplY3QgYXMgcHVibGljLiAqL1xuICByZWFkb25seSBlcnJvcnM6IHN0cmluZ1tdO1xuICAvKiogU2VydmljZSBwcmluY2lwYWxzIGFsbG93ZWQgd2l0aG91dCBhIHNvdXJjZSBjb25kaXRpb24uICovXG4gIHJlYWRvbmx5IHVuc2NvcGVkU2VydmljZXM6IHN0cmluZ1tdO1xufVxuXG4vKiogSW5zcGVjdHMgYSByZXNvbHZlZCBwb2xpY3kgZG9jdW1lbnQgKGB7IFN0YXRlbWVudDogWy4uLl0gfWApLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGluc3BlY3RSZXNvdXJjZVBvbGljeShkb2N1bWVudDogYW55KTogUmVzb3VyY2VQb2xpY3lGaW5kaW5ncyB7XG4gIGNvbnN0IGVycm9yczogc3RyaW5nW10gPSBbXTtcbiAgY29uc3QgdW5zY29wZWRTZXJ2aWNlczogc3RyaW5nW10gPSBbXTtcbiAgZm9yIChjb25zdCBbaSwgc10gb2YgKGRvY3VtZW50Py5TdGF0ZW1lbnQgPz8gW10pLmVudHJpZXMoKSkge1xuICAgIGlmIChzLkVmZmVjdCAhPT0gJ0FsbG93JykgY29udGludWU7XG4gICAgY29uc3Qga2V5cyA9IGNvbmRpdGlvbktleXMocy5Db25kaXRpb24pO1xuICAgIGNvbnN0IG5hbWUgPSBzLlNpZCA/IGBzdGF0ZW1lbnQgJyR7cy5TaWR9J2AgOiBgc3RhdGVtZW50ICR7aSArIDF9YDtcbiAgICBpZiAoaXNXaWxkY2FyZChzLlByaW5jaXBhbCkgJiYgIWtleXMuc29tZSgoaykgPT4gVFJVU1RFRF9LRVlTLmluY2x1ZGVzKGspKSkge1xuICAgICAgZXJyb3JzLnB1c2goYCR7bmFtZX0gYWxsb3dzIHByaW5jaXBhbCAnKic6IExhbWJkYSByZWplY3RzIHB1YmxpYyByZXNvdXJjZSBwb2xpY2llcy4gUGluIHRoZSBjYWxsZXIgd2l0aCBhIGNvbmRpdGlvbiBzdWNoIGFzIGF3czpQcmluY2lwYWxPcmdJRCBvciBhd3M6U291cmNlQWNjb3VudCAoZS5nLiBpYW0uT3JnYW5pemF0aW9uUHJpbmNpcGFsKSwgb3IgbmFtZSB0aGUgYWNjb3VudHNgKTtcbiAgICB9XG4gICAgY29uc3Qgc2VydmljZXMgPSBsaXN0KHMuUHJpbmNpcGFsPy5TZXJ2aWNlKS5tYXAoU3RyaW5nKTtcbiAgICBpZiAoc2VydmljZXMubGVuZ3RoID4gMCAmJiAha2V5cy5zb21lKChrKSA9PiBTT1VSQ0VfS0VZUy5pbmNsdWRlcyhrKSkpIHtcbiAgICAgIHVuc2NvcGVkU2VydmljZXMucHVzaCguLi5zZXJ2aWNlcyk7XG4gICAgfVxuICB9XG4gIHJldHVybiB7IGVycm9ycywgdW5zY29wZWRTZXJ2aWNlcyB9O1xufVxuXG5mdW5jdGlvbiBpc1dpbGRjYXJkKHByaW5jaXBhbDogYW55KTogYm9vbGVhbiB7XG4gIHJldHVybiBwcmluY2lwYWwgPT09ICcqJyB8fCBsaXN0KHByaW5jaXBhbD8uQVdTKS5pbmNsdWRlcygnKicpO1xufVxuXG5mdW5jdGlvbiBjb25kaXRpb25LZXlzKGNvbmRpdGlvbjogYW55KTogc3RyaW5nW10ge1xuICByZXR1cm4gT2JqZWN0LnZhbHVlcyhjb25kaXRpb24gPz8ge30pLmZsYXRNYXAoKGJ5S2V5OiBhbnkpID0+IE9iamVjdC5rZXlzKGJ5S2V5ID8/IHt9KSkubWFwKChrKSA9PiBrLnRvTG93ZXJDYXNlKCkpO1xufVxuXG5mdW5jdGlvbiBsaXN0KHZhbHVlOiB1bmtub3duKTogdW5rbm93bltdIHtcbiAgcmV0dXJuIHZhbHVlID09PSB1bmRlZmluZWQgPyBbXSA6IEFycmF5LmlzQXJyYXkodmFsdWUpID8gdmFsdWUgOiBbdmFsdWVdO1xufVxuIl19

package/lib/web-function-deployment.js

@@ -11,7 +11,7 @@ const MAX_STEPS = 20;
  * How an endpoint moves its traffic to a new revision.
  */
 class WebFunctionDeployment {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionDeployment", version: "0.1.4" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionDeployment", version: "0.1.6" };
     /**
      * All traffic moves to the new revision at once, as soon as it's ready (the default).
      */

package/lib/web-function-endpoint.d.ts

@@ -152,13 +152,14 @@ export declare class WebFunctionEndpoint extends Construct {
     readonly url: string;
     /** Grants on this endpoint (e.g. `grants.invoke(principal)`). */
     readonly grants: WebFunctionGrants;
+    /** The function this endpoint belongs to. */
+    readonly webFunction: IWebFunction;
     /**
      * The alarms this endpoint created for its deployment's `rollbackOn`, one per threshold in every region it serves from
      * (the home region's first). Empty without `rollbackOn`.
      */
     readonly rollbackAlarms: cloudwatch.IAlarm[];
     private readonly homeRegion;
-    private readonly webFunction;
     private readonly resource;
     private weights;
     private routed;
@@ -171,6 +172,12 @@ export declare class WebFunctionEndpoint extends Construct {
      * @param region one of `regions`
      */
     regionalUrl(region: string): string;
+    /**
+     * The domain name of this endpoint in one region. Only for `PER_REGION` endpoints.
+     *
+     * @param region one of `regions`
+     */
+    regionalDomainName(region: string): string;
     /**
      * Routes the endpoint to `revision` instead of the function's current revision, optionally sharing
      * traffic with one more revision (`additionalRevisions`, which gets its weight; `revision` gets the rest).