@ashishpandeyone/cdk-lambda-web-function 0.1.7 → 0.1.9

package/lib/nodejs-web-function.js

@@ -49,7 +49,7 @@ const web_function_1 = require("./web-function");
  * bundle, and `NODE_OPTIONS=--enable-source-maps` when source maps are on.
  */
 class NodejsWebFunction extends web_function_1.WebFunction {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction", version: "0.1.7" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction", version: "0.1.9" };
     constructor(scope, id, props) {
         const runtime = props.runtime ?? lambda.Runtime.NODEJS_24_X;
         const entry = (0, bundling_1.resolveEntry)(props.entry);

package/lib/private/code-bucket.js

@@ -37,6 +37,7 @@ exports.codeBucket = codeBucket;
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const iam = __importStar(require("aws-cdk-lib/aws-iam"));
 const s3 = __importStar(require("aws-cdk-lib/aws-s3"));
+const nag_1 = require("./nag");
 const provider_1 = require("./provider");
 const provider_protocol_1 = require("./provider-protocol");
 const ID = 'LambdaWebFunctionCodeBucket';
@@ -68,6 +69,7 @@ function codeBucket(scope) {
                 abortIncompleteMultipartUploadAfter: aws_cdk_lib_1.Duration.days(1),
             }],
     });
+    (0, nag_1.acknowledgeNagRules)(bucket.node.defaultChild, ['AwsSolutions-S1'], 'Holds only copies of this stack\'s code assets, written by the stack\'s own custom resource provider');
     bucket.addToResourcePolicy(new iam.PolicyStatement({
         sid: 'LambdaWebFunctionsReadCode',
         principals: [new iam.ServicePrincipal('lambda.amazonaws.com')],
@@ -89,4 +91,4 @@ function codeBucket(scope) {
     });
     return bucket;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29kZS1idWNrZXQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcHJpdmF0ZS9jb2RlLWJ1Y2tldC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQW9CQSxnQ0FzQ0M7QUExREQsNkNBQW1GO0FBQ25GLHlEQUEyQztBQUMzQyx1REFBeUM7QUFFekMseUNBQWtFO0FBQ2xFLDJEQUErSDtBQUUvSCxNQUFNLEVBQUUsR0FBRyw2QkFBNkIsQ0FBQztBQUV6Qzs7Ozs7Ozs7OztHQVVHO0FBQ0gsU0FBZ0IsVUFBVSxDQUFDLEtBQWdCO0lBQ3pDLE1BQU0sS0FBSyxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzlCLE1BQU0sUUFBUSxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBMEIsQ0FBQztJQUN0RSxJQUFJLFFBQVE7UUFBRSxPQUFPLFFBQVEsQ0FBQztJQUU5QixNQUFNLE1BQU0sR0FBRyxJQUFJLEVBQUUsQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtRQUN0QyxTQUFTLEVBQUUsSUFBSTtRQUNmLFVBQVUsRUFBRSxJQUFJO1FBQ2hCLGlCQUFpQixFQUFFLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQyxTQUFTO1FBQ2pELFVBQVUsRUFBRSxFQUFFLENBQUMsZ0JBQWdCLENBQUMsVUFBVTtRQUMxQyxhQUFhLEVBQUUsMkJBQWEsQ0FBQyxPQUFPO1FBQ3BDLGNBQWMsRUFBRSxDQUFDO2dCQUNmLEVBQUUsRUFBRSxzQkFBc0I7Z0JBQzFCLDJCQUEyQixFQUFFLHNCQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztnQkFDOUMsbUNBQW1DLEVBQUUsc0JBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO2FBQ3RELENBQUM7S0FDSCxDQUFDLENBQUM7SUFDSCxNQUFNLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO1FBQ2pELEdBQUcsRUFBRSw0QkFBNEI7UUFDakMsVUFBVSxFQUFFLENBQUMsSUFBSSxHQUFHLENBQUMsZ0JBQWdCLENBQUMsc0JBQXNCLENBQUMsQ0FBQztRQUM5RCxPQUFPLEVBQUUsQ0FBQyxjQUFjLEVBQUUscUJBQXFCLENBQUM7UUFDaEQsU0FBUyxFQUFFLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUN0QyxVQUFVLEVBQUUsRUFBRSxZQUFZLEVBQUUsRUFBRSxtQkFBbUIsRUFBRSxLQUFLLENBQUMsT0FBTyxFQUFFLEVBQUU7S0FDckUsQ0FBQyxDQUFDLENBQUM7SUFFSiw2REFBNkQ7SUFDN0Qsa0JBQUksQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLENBQUMsR0FBRyxDQUFDLHVDQUFtQixDQUFDLEdBQUcsRUFBRSx1Q0FBbUIsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN4RSxNQUFNLFFBQVEsR0FBRyxJQUFBLDhCQUFtQixFQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzVDLElBQUEsMEJBQWUsRUFBQyxRQUFRLEVBQUUsRUFBRSxNQUFNLEVBQUUsQ0FBQyx1QkFBdUIsRUFBRSxxQkFBcUIsQ0FBQyxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUNwSCxJQUFBLDBCQUFlLEVBQUMsUUFBUSxFQUFFLEVBQUUsTUFBTSxFQUFFLENBQUMsaUJBQWlCLEVBQUUsd0JBQXdCLENBQUMsRUFBRSxRQUFRLEVBQUUsTUFBTSxDQUFDLGFBQWEsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDMUgsTUFBTSxVQUFVLEdBQWdDLEVBQUUsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQztJQUNsRixxR0FBcUc7SUFDckcsSUFBSSw0QkFBYyxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsU0FBUyxFQUFFO1FBQ3hDLFlBQVksRUFBRSxRQUFRLENBQUMsWUFBWTtRQUNuQyxZQUFZLEVBQUUscURBQWlDO1FBQy9DLFVBQVUsRUFBRSxFQUFFLEdBQUcsVUFBVSxFQUFFO0tBQzlCLENBQUMsQ0FBQztJQUNILE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDdXN0b21SZXNvdXJjZSwgRHVyYXRpb24sIFJlbW92YWxQb2xpY3ksIFN0YWNrLCBUYWdzIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0ICogYXMgaWFtIGZyb20gJ2F3cy1jZGstbGliL2F3cy1pYW0nO1xuaW1wb3J0ICogYXMgczMgZnJvbSAnYXdzLWNkay1saWIvYXdzLXMzJztcbmltcG9ydCB0eXBlIHsgQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQgeyBncmFudFRvUHJvdmlkZXIsIHdlYkZ1bmN0aW9uUHJvdmlkZXIgfSBmcm9tICcuL3Byb3ZpZGVyJztcbmltcG9ydCB7IENPREVfQlVDS0VUX0NMRUFOVVBfUkVTT1VSQ0VfVFlQRSwgRU1QVFlfT05fREVMRVRFX1RBRywgdHlwZSBDb2RlQnVja2V0Q2xlYW51cFByb3BlcnRpZXMgfSBmcm9tICcuL3Byb3ZpZGVyLXByb3RvY29sJztcblxuY29uc3QgSUQgPSAnTGFtYmRhV2ViRnVuY3Rpb25Db2RlQnVja2V0JztcblxuLyoqXG4gKiBUaGUgc3RhY2sncyBjb2RlIGJ1Y2tldCAob25lIHBlciBzdGFjaykuXG4gKlxuICogTGFtYmRhIFdlYiBGdW5jdGlvbnMgZG93bmxvYWQgY29kZSBhcyB0aGUgYGxhbWJkYS5hbWF6b25hd3MuY29tYCBzZXJ2aWNlIHByaW5jaXBhbCBhbmRcbiAqIHJlamVjdCB1bnZlcnNpb25lZCBidWNrZXRzOyB0aGUgQ0RLIGJvb3RzdHJhcCBidWNrZXQgYWxsb3dzIG5laXRoZXIsIHNvIGNvZGUgaXMgY29waWVkIGhlcmUuXG4gKiBSZXZpc2lvbnMgY2FwdHVyZSB0aGVpciBjb2RlIHdoZW4gdGhleSdyZSBjcmVhdGVkLCBzbyBzdXBlcnNlZGVkIHZlcnNpb25zIGNhbiBleHBpcmUsIGJ1dFxuICogY3VycmVudCBvYmplY3RzIG11c3Qgc3RheTogYSBsYXRlciByZXZpc2lvbiBtYXkgYmUgY3JlYXRlZCBmcm9tIHRoZSBzYW1lIG9iamVjdC5cbiAqXG4gKiBUaGUgc2hhcmVkIHByb3ZpZGVyIGVtcHRpZXMgaXQgd2hlbiBpdCdzIGRlbGV0ZWQgKGluc3RlYWQgb2YgYGF1dG9EZWxldGVPYmplY3RzYCwgd2hpY2ggYWRkcyBhbm90aGVyXG4gKiBMYW1iZGEgZnVuY3Rpb24gd2hvc2UgbG9nIGdyb3VwIG91dGxpdmVzIHRoZSBzdGFjaykuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjb2RlQnVja2V0KHNjb3BlOiBDb25zdHJ1Y3QpOiBzMy5CdWNrZXQge1xuICBjb25zdCBzdGFjayA9IFN0YWNrLm9mKHNjb3BlKTtcbiAgY29uc3QgZXhpc3RpbmcgPSBzdGFjay5ub2RlLnRyeUZpbmRDaGlsZChJRCkgYXMgczMuQnVja2V0IHwgdW5kZWZpbmVkO1xuICBpZiAoZXhpc3RpbmcpIHJldHVybiBleGlzdGluZztcblxuICBjb25zdCBidWNrZXQgPSBuZXcgczMuQnVja2V0KHN0YWNrLCBJRCwge1xuICAgIHZlcnNpb25lZDogdHJ1ZSxcbiAgICBlbmZvcmNlU1NMOiB0cnVlLFxuICAgIGJsb2NrUHVibGljQWNjZXNzOiBzMy5CbG9ja1B1YmxpY0FjY2Vzcy5CTE9DS19BTEwsXG4gICAgZW5jcnlwdGlvbjogczMuQnVja2V0RW5jcnlwdGlvbi5TM19NQU5BR0VELFxuICAgIHJlbW92YWxQb2xpY3k6IFJlbW92YWxQb2xpY3kuREVTVFJPWSxcbiAgICBsaWZlY3ljbGVSdWxlczogW3tcbiAgICAgIGlkOiAnRXhwaXJlU3VwZXJzZWRlZENvZGUnLFxuICAgICAgbm9uY3VycmVudFZlcnNpb25FeHBpcmF0aW9uOiBEdXJhdGlvbi5kYXlzKDMwKSxcbiAgICAgIGFib3J0SW5jb21wbGV0ZU11bHRpcGFydFVwbG9hZEFmdGVyOiBEdXJhdGlvbi5kYXlzKDEpLFxuICAgIH1dLFxuICB9KTtcbiAgYnVja2V0LmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgIHNpZDogJ0xhbWJkYVdlYkZ1bmN0aW9uc1JlYWRDb2RlJyxcbiAgICBwcmluY2lwYWxzOiBbbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKCdsYW1iZGEuYW1hem9uYXdzLmNvbScpXSxcbiAgICBhY3Rpb25zOiBbJ3MzOkdldE9iamVjdCcsICdzMzpHZXRPYmplY3RWZXJzaW9uJ10sXG4gICAgcmVzb3VyY2VzOiBbYnVja2V0LmFybkZvck9iamVjdHMoJyonKV0sXG4gICAgY29uZGl0aW9uczogeyBTdHJpbmdFcXVhbHM6IHsgJ2F3czpTb3VyY2VBY2NvdW50Jzogc3RhY2suYWNjb3VudCB9IH0sXG4gIH0pKTtcblxuICAvLyBPbmx5IGEgdGFnZ2VkIGJ1Y2tldCBpcyBlbXB0aWVkIChzZWUgRU1QVFlfT05fREVMRVRFX1RBRykuXG4gIFRhZ3Mub2YoYnVja2V0KS5hZGQoRU1QVFlfT05fREVMRVRFX1RBRy5rZXksIEVNUFRZX09OX0RFTEVURV9UQUcudmFsdWUpO1xuICBjb25zdCBwcm92aWRlciA9IHdlYkZ1bmN0aW9uUHJvdmlkZXIoc3RhY2spO1xuICBncmFudFRvUHJvdmlkZXIocHJvdmlkZXIsIHsgQWN0aW9uOiBbJ3MzOkxpc3RCdWNrZXRWZXJzaW9ucycsICdzMzpHZXRCdWNrZXRUYWdnaW5nJ10sIFJlc291cmNlOiBidWNrZXQuYnVja2V0QXJuIH0pO1xuICBncmFudFRvUHJvdmlkZXIocHJvdmlkZXIsIHsgQWN0aW9uOiBbJ3MzOkRlbGV0ZU9iamVjdCcsICdzMzpEZWxldGVPYmplY3RWZXJzaW9uJ10sIFJlc291cmNlOiBidWNrZXQuYXJuRm9yT2JqZWN0cygnKicpIH0pO1xuICBjb25zdCBwcm9wZXJ0aWVzOiBDb2RlQnVja2V0Q2xlYW51cFByb3BlcnRpZXMgPSB7IEJ1Y2tldE5hbWU6IGJ1Y2tldC5idWNrZXROYW1lIH07XG4gIC8vIERlcGVuZHMgb24gdGhlIGJ1Y2tldCAodGhyb3VnaCBpdHMgbmFtZSksIHNvIGl0J3MgZGVsZXRlZCwgYW5kIGVtcHRpZXMgaXQsIGp1c3QgYmVmb3JlIHRoZSBidWNrZXQuXG4gIG5ldyBDdXN0b21SZXNvdXJjZShzdGFjaywgYCR7SUR9Q2xlYW51cGAsIHtcbiAgICBzZXJ2aWNlVG9rZW46IHByb3ZpZGVyLnNlcnZpY2VUb2tlbixcbiAgICByZXNvdXJjZVR5cGU6IENPREVfQlVDS0VUX0NMRUFOVVBfUkVTT1VSQ0VfVFlQRSxcbiAgICBwcm9wZXJ0aWVzOiB7IC4uLnByb3BlcnRpZXMgfSxcbiAgfSk7XG4gIHJldHVybiBidWNrZXQ7XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29kZS1idWNrZXQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcHJpdmF0ZS9jb2RlLWJ1Y2tldC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQXFCQSxnQ0F3Q0M7QUE3REQsNkNBQW1GO0FBQ25GLHlEQUEyQztBQUMzQyx1REFBeUM7QUFFekMsK0JBQTRDO0FBQzVDLHlDQUFrRTtBQUNsRSwyREFBK0g7QUFFL0gsTUFBTSxFQUFFLEdBQUcsNkJBQTZCLENBQUM7QUFFekM7Ozs7Ozs7Ozs7R0FVRztBQUNILFNBQWdCLFVBQVUsQ0FBQyxLQUFnQjtJQUN6QyxNQUFNLEtBQUssR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUM5QixNQUFNLFFBQVEsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQTBCLENBQUM7SUFDdEUsSUFBSSxRQUFRO1FBQUUsT0FBTyxRQUFRLENBQUM7SUFFOUIsTUFBTSxNQUFNLEdBQUcsSUFBSSxFQUFFLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUU7UUFDdEMsU0FBUyxFQUFFLElBQUk7UUFDZixVQUFVLEVBQUUsSUFBSTtRQUNoQixpQkFBaUIsRUFBRSxFQUFFLENBQUMsaUJBQWlCLENBQUMsU0FBUztRQUNqRCxVQUFVLEVBQUUsRUFBRSxDQUFDLGdCQUFnQixDQUFDLFVBQVU7UUFDMUMsYUFBYSxFQUFFLDJCQUFhLENBQUMsT0FBTztRQUNwQyxjQUFjLEVBQUUsQ0FBQztnQkFDZixFQUFFLEVBQUUsc0JBQXNCO2dCQUMxQiwyQkFBMkIsRUFBRSxzQkFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7Z0JBQzlDLG1DQUFtQyxFQUFFLHNCQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQzthQUN0RCxDQUFDO0tBQ0gsQ0FBQyxDQUFDO0lBQ0gsSUFBQSx5QkFBbUIsRUFBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFlBQTRCLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQyxFQUMvRSxzR0FBc0csQ0FBQyxDQUFDO0lBQzFHLE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7UUFDakQsR0FBRyxFQUFFLDRCQUE0QjtRQUNqQyxVQUFVLEVBQUUsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDO1FBQzlELE9BQU8sRUFBRSxDQUFDLGNBQWMsRUFBRSxxQkFBcUIsQ0FBQztRQUNoRCxTQUFTLEVBQUUsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3RDLFVBQVUsRUFBRSxFQUFFLFlBQVksRUFBRSxFQUFFLG1CQUFtQixFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsRUFBRTtLQUNyRSxDQUFDLENBQUMsQ0FBQztJQUVKLDZEQUE2RDtJQUM3RCxrQkFBSSxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxHQUFHLENBQUMsdUNBQW1CLENBQUMsR0FBRyxFQUFFLHVDQUFtQixDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3hFLE1BQU0sUUFBUSxHQUFHLElBQUEsOEJBQW1CLEVBQUMsS0FBSyxDQUFDLENBQUM7SUFDNUMsSUFBQSwwQkFBZSxFQUFDLFFBQVEsRUFBRSxFQUFFLE1BQU0sRUFBRSxDQUFDLHVCQUF1QixFQUFFLHFCQUFxQixDQUFDLEVBQUUsUUFBUSxFQUFFLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQ3BILElBQUEsMEJBQWUsRUFBQyxRQUFRLEVBQUUsRUFBRSxNQUFNLEVBQUUsQ0FBQyxpQkFBaUIsRUFBRSx3QkFBd0IsQ0FBQyxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsYUFBYSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUMxSCxNQUFNLFVBQVUsR0FBZ0MsRUFBRSxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO0lBQ2xGLHFHQUFxRztJQUNyRyxJQUFJLDRCQUFjLENBQUMsS0FBSyxFQUFFLEdBQUcsRUFBRSxTQUFTLEVBQUU7UUFDeEMsWUFBWSxFQUFFLFFBQVEsQ0FBQyxZQUFZO1FBQ25DLFlBQVksRUFBRSxxREFBaUM7UUFDL0MsVUFBVSxFQUFFLEVBQUUsR0FBRyxVQUFVLEVBQUU7S0FDOUIsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IEN1c3RvbVJlc291cmNlLCBEdXJhdGlvbiwgUmVtb3ZhbFBvbGljeSwgU3RhY2ssIFRhZ3MgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWlhbSc7XG5pbXBvcnQgKiBhcyBzMyBmcm9tICdhd3MtY2RrLWxpYi9hd3MtczMnO1xuaW1wb3J0IHR5cGUgeyBDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7IGFja25vd2xlZGdlTmFnUnVsZXMgfSBmcm9tICcuL25hZyc7XG5pbXBvcnQgeyBncmFudFRvUHJvdmlkZXIsIHdlYkZ1bmN0aW9uUHJvdmlkZXIgfSBmcm9tICcuL3Byb3ZpZGVyJztcbmltcG9ydCB7IENPREVfQlVDS0VUX0NMRUFOVVBfUkVTT1VSQ0VfVFlQRSwgRU1QVFlfT05fREVMRVRFX1RBRywgdHlwZSBDb2RlQnVja2V0Q2xlYW51cFByb3BlcnRpZXMgfSBmcm9tICcuL3Byb3ZpZGVyLXByb3RvY29sJztcblxuY29uc3QgSUQgPSAnTGFtYmRhV2ViRnVuY3Rpb25Db2RlQnVja2V0JztcblxuLyoqXG4gKiBUaGUgc3RhY2sncyBjb2RlIGJ1Y2tldCAob25lIHBlciBzdGFjaykuXG4gKlxuICogTGFtYmRhIFdlYiBGdW5jdGlvbnMgZG93bmxvYWQgY29kZSBhcyB0aGUgYGxhbWJkYS5hbWF6b25hd3MuY29tYCBzZXJ2aWNlIHByaW5jaXBhbCBhbmRcbiAqIHJlamVjdCB1bnZlcnNpb25lZCBidWNrZXRzOyB0aGUgQ0RLIGJvb3RzdHJhcCBidWNrZXQgYWxsb3dzIG5laXRoZXIsIHNvIGNvZGUgaXMgY29waWVkIGhlcmUuXG4gKiBSZXZpc2lvbnMgY2FwdHVyZSB0aGVpciBjb2RlIHdoZW4gdGhleSdyZSBjcmVhdGVkLCBzbyBzdXBlcnNlZGVkIHZlcnNpb25zIGNhbiBleHBpcmUsIGJ1dFxuICogY3VycmVudCBvYmplY3RzIG11c3Qgc3RheTogYSBsYXRlciByZXZpc2lvbiBtYXkgYmUgY3JlYXRlZCBmcm9tIHRoZSBzYW1lIG9iamVjdC5cbiAqXG4gKiBUaGUgc2hhcmVkIHByb3ZpZGVyIGVtcHRpZXMgaXQgd2hlbiBpdCdzIGRlbGV0ZWQgKGluc3RlYWQgb2YgYGF1dG9EZWxldGVPYmplY3RzYCwgd2hpY2ggYWRkcyBhbm90aGVyXG4gKiBMYW1iZGEgZnVuY3Rpb24gd2hvc2UgbG9nIGdyb3VwIG91dGxpdmVzIHRoZSBzdGFjaykuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjb2RlQnVja2V0KHNjb3BlOiBDb25zdHJ1Y3QpOiBzMy5CdWNrZXQge1xuICBjb25zdCBzdGFjayA9IFN0YWNrLm9mKHNjb3BlKTtcbiAgY29uc3QgZXhpc3RpbmcgPSBzdGFjay5ub2RlLnRyeUZpbmRDaGlsZChJRCkgYXMgczMuQnVja2V0IHwgdW5kZWZpbmVkO1xuICBpZiAoZXhpc3RpbmcpIHJldHVybiBleGlzdGluZztcblxuICBjb25zdCBidWNrZXQgPSBuZXcgczMuQnVja2V0KHN0YWNrLCBJRCwge1xuICAgIHZlcnNpb25lZDogdHJ1ZSxcbiAgICBlbmZvcmNlU1NMOiB0cnVlLFxuICAgIGJsb2NrUHVibGljQWNjZXNzOiBzMy5CbG9ja1B1YmxpY0FjY2Vzcy5CTE9DS19BTEwsXG4gICAgZW5jcnlwdGlvbjogczMuQnVja2V0RW5jcnlwdGlvbi5TM19NQU5BR0VELFxuICAgIHJlbW92YWxQb2xpY3k6IFJlbW92YWxQb2xpY3kuREVTVFJPWSxcbiAgICBsaWZlY3ljbGVSdWxlczogW3tcbiAgICAgIGlkOiAnRXhwaXJlU3VwZXJzZWRlZENvZGUnLFxuICAgICAgbm9uY3VycmVudFZlcnNpb25FeHBpcmF0aW9uOiBEdXJhdGlvbi5kYXlzKDMwKSxcbiAgICAgIGFib3J0SW5jb21wbGV0ZU11bHRpcGFydFVwbG9hZEFmdGVyOiBEdXJhdGlvbi5kYXlzKDEpLFxuICAgIH1dLFxuICB9KTtcbiAgYWNrbm93bGVkZ2VOYWdSdWxlcyhidWNrZXQubm9kZS5kZWZhdWx0Q2hpbGQgYXMgczMuQ2ZuQnVja2V0LCBbJ0F3c1NvbHV0aW9ucy1TMSddLFxuICAgICdIb2xkcyBvbmx5IGNvcGllcyBvZiB0aGlzIHN0YWNrXFwncyBjb2RlIGFzc2V0cywgd3JpdHRlbiBieSB0aGUgc3RhY2tcXCdzIG93biBjdXN0b20gcmVzb3VyY2UgcHJvdmlkZXInKTtcbiAgYnVja2V0LmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgIHNpZDogJ0xhbWJkYVdlYkZ1bmN0aW9uc1JlYWRDb2RlJyxcbiAgICBwcmluY2lwYWxzOiBbbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKCdsYW1iZGEuYW1hem9uYXdzLmNvbScpXSxcbiAgICBhY3Rpb25zOiBbJ3MzOkdldE9iamVjdCcsICdzMzpHZXRPYmplY3RWZXJzaW9uJ10sXG4gICAgcmVzb3VyY2VzOiBbYnVja2V0LmFybkZvck9iamVjdHMoJyonKV0sXG4gICAgY29uZGl0aW9uczogeyBTdHJpbmdFcXVhbHM6IHsgJ2F3czpTb3VyY2VBY2NvdW50Jzogc3RhY2suYWNjb3VudCB9IH0sXG4gIH0pKTtcblxuICAvLyBPbmx5IGEgdGFnZ2VkIGJ1Y2tldCBpcyBlbXB0aWVkIChzZWUgRU1QVFlfT05fREVMRVRFX1RBRykuXG4gIFRhZ3Mub2YoYnVja2V0KS5hZGQoRU1QVFlfT05fREVMRVRFX1RBRy5rZXksIEVNUFRZX09OX0RFTEVURV9UQUcudmFsdWUpO1xuICBjb25zdCBwcm92aWRlciA9IHdlYkZ1bmN0aW9uUHJvdmlkZXIoc3RhY2spO1xuICBncmFudFRvUHJvdmlkZXIocHJvdmlkZXIsIHsgQWN0aW9uOiBbJ3MzOkxpc3RCdWNrZXRWZXJzaW9ucycsICdzMzpHZXRCdWNrZXRUYWdnaW5nJ10sIFJlc291cmNlOiBidWNrZXQuYnVja2V0QXJuIH0pO1xuICBncmFudFRvUHJvdmlkZXIocHJvdmlkZXIsIHsgQWN0aW9uOiBbJ3MzOkRlbGV0ZU9iamVjdCcsICdzMzpEZWxldGVPYmplY3RWZXJzaW9uJ10sIFJlc291cmNlOiBidWNrZXQuYXJuRm9yT2JqZWN0cygnKicpIH0pO1xuICBjb25zdCBwcm9wZXJ0aWVzOiBDb2RlQnVja2V0Q2xlYW51cFByb3BlcnRpZXMgPSB7IEJ1Y2tldE5hbWU6IGJ1Y2tldC5idWNrZXROYW1lIH07XG4gIC8vIERlcGVuZHMgb24gdGhlIGJ1Y2tldCAodGhyb3VnaCBpdHMgbmFtZSksIHNvIGl0J3MgZGVsZXRlZCwgYW5kIGVtcHRpZXMgaXQsIGp1c3QgYmVmb3JlIHRoZSBidWNrZXQuXG4gIG5ldyBDdXN0b21SZXNvdXJjZShzdGFjaywgYCR7SUR9Q2xlYW51cGAsIHtcbiAgICBzZXJ2aWNlVG9rZW46IHByb3ZpZGVyLnNlcnZpY2VUb2tlbixcbiAgICByZXNvdXJjZVR5cGU6IENPREVfQlVDS0VUX0NMRUFOVVBfUkVTT1VSQ0VfVFlQRSxcbiAgICBwcm9wZXJ0aWVzOiB7IC4uLnByb3BlcnRpZXMgfSxcbiAgfSk7XG4gIHJldHVybiBidWNrZXQ7XG59XG4iXX0=

package/lib/private/nag.d.ts

@@ -0,0 +1,19 @@
+import { CfnResource } from 'aws-cdk-lib';
+import type { IConstruct } from 'constructs';
+/**
+ * Acknowledges cdk-nag AwsSolutions findings on resources this library creates, so teams that run cdk-nag don't have
+ * to acknowledge our internals. Written for both major versions, without depending on cdk-nag:
+ * - cdk-nag 3 reads CDK's `Validations.of(resource).acknowledge()`, one id per finding (`AwsSolutions::<rule>[<finding>]`);
+ * - cdk-nag 2 reads `cdk_nag` metadata, where a rule without `applies_to` covers all its findings.
+ */
+export declare function acknowledgeNagRules(resource: CfnResource, rules: string[], reason: string): void;
+/**
+ * Acknowledges the IAM findings of a role or policy whose permissions are all this library's: wildcards (IAM5) and,
+ * with `managedPolicies`, AWS managed policies (IAM4). Finding ids depend on the resolved policy (logical IDs, the
+ * stack's environment), so they're computed when the app is synthesized.
+ */
+export declare function acknowledgeIamFindings(resource: CfnResource, reason: string, options?: {
+    managedPolicies?: boolean;
+}): void;
+/** Acknowledges IAM findings on every role and policy under `scope`, and the given rules on matching resources. */
+export declare function acknowledgeNagUnder(scope: IConstruct, reason: string, rulesByType?: Record<string, string[]>): void;

package/lib/private/nag.js

@@ -0,0 +1,139 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.acknowledgeNagRules = acknowledgeNagRules;
+exports.acknowledgeIamFindings = acknowledgeIamFindings;
+exports.acknowledgeNagUnder = acknowledgeNagUnder;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const iam = __importStar(require("aws-cdk-lib/aws-iam"));
+/**
+ * Acknowledges cdk-nag AwsSolutions findings on resources this library creates, so teams that run cdk-nag don't have
+ * to acknowledge our internals. Written for both major versions, without depending on cdk-nag:
+ * - cdk-nag 3 reads CDK's `Validations.of(resource).acknowledge()`, one id per finding (`AwsSolutions::<rule>[<finding>]`);
+ * - cdk-nag 2 reads `cdk_nag` metadata, where a rule without `applies_to` covers all its findings.
+ */
+function acknowledgeNagRules(resource, rules, reason) {
+    for (const rule of rules)
+        aws_cdk_lib_1.Validations.of(resource).acknowledge({ id: `AwsSolutions::${rule}`, reason });
+    addV2Suppressions(resource, rules, reason);
+}
+/**
+ * Acknowledges the IAM findings of a role or policy whose permissions are all this library's: wildcards (IAM5) and,
+ * with `managedPolicies`, AWS managed policies (IAM4). Finding ids depend on the resolved policy (logical IDs, the
+ * stack's environment), so they're computed when the app is synthesized.
+ */
+function acknowledgeIamFindings(resource, reason, options = {}) {
+    addV2Suppressions(resource, ['AwsSolutions-IAM5', ...(options.managedPolicies ? ['AwsSolutions-IAM4'] : [])], reason);
+    resource.node.addValidation({
+        validate: () => {
+            for (const finding of iamFindings(resource, options.managedPolicies ?? false)) {
+                aws_cdk_lib_1.Validations.of(resource).acknowledge({ id: `AwsSolutions::${finding}`, reason });
+            }
+            return [];
+        },
+    });
+}
+/** Acknowledges IAM findings on every role and policy under `scope`, and the given rules on matching resources. */
+function acknowledgeNagUnder(scope, reason, rulesByType = {}) {
+    for (const child of scope.node.findAll()) {
+        if (!aws_cdk_lib_1.CfnResource.isCfnResource(child))
+            continue;
+        if (child instanceof iam.CfnRole || child instanceof iam.CfnPolicy)
+            acknowledgeIamFindings(child, reason, { managedPolicies: true });
+        const rules = rulesByType[child.cfnResourceType];
+        if (rules)
+            acknowledgeNagRules(child, rules, reason);
+    }
+}
+function iamFindings(resource, managedPolicies) {
+    const stack = aws_cdk_lib_1.Stack.of(resource);
+    const documents = [];
+    const findings = [];
+    if (resource instanceof iam.CfnPolicy) {
+        documents.push(stack.resolve(resource.policyDocument));
+    }
+    else if (resource instanceof iam.CfnRole) {
+        for (const policy of stack.resolve(resource.policies) ?? [])
+            documents.push(stack.resolve(stack.resolve(policy).policyDocument));
+        if (managedPolicies) {
+            for (const arn of stack.resolve(resource.managedPolicyArns) ?? [])
+                findings.push(`AwsSolutions-IAM4[Policy::${flatten(arn)}]`);
+        }
+    }
+    for (const document of documents) {
+        for (const statement of document?.Statement ?? []) {
+            if (statement.Effect !== 'Allow')
+                continue;
+            for (const action of list(statement.Action))
+                if (String(action).includes('*'))
+                    findings.push(`AwsSolutions-IAM5[Action::${action}]`);
+            for (const r of list(statement.Resource)) {
+                const flat = flatten(r);
+                if (flat.includes('*'))
+                    findings.push(`AwsSolutions-IAM5[Resource::${flat}]`);
+            }
+        }
+    }
+    return [...new Set(findings)];
+}
+/** cdk-nag's own flattening of CloudFormation references in finding ids (`utils/flatten-cfn-reference`). */
+function flatten(node) {
+    if (node === undefined)
+        return '';
+    if (typeof node === 'string')
+        return node.replace(/\$\{/g, '<').replace(/}/g, '>');
+    if (node['Fn::Join']) {
+        const [delimiter, items] = node['Fn::Join'];
+        return items.map(flatten).join(delimiter);
+    }
+    if (node['Fn::Sub'])
+        return flatten(node['Fn::Sub']);
+    if (node['Fn::GetAtt'])
+        return `<${flatten(node['Fn::GetAtt'][0])}.${flatten(node['Fn::GetAtt'][1])}>`;
+    if (node['Fn::ImportValue'])
+        return flatten(node['Fn::ImportValue']);
+    if (node.Ref)
+        return `<${flatten(node.Ref)}>`;
+    return JSON.stringify(node);
+}
+function addV2Suppressions(resource, rules, reason) {
+    const existing = resource.getMetadata('cdk_nag')?.rules_to_suppress ?? [];
+    const ids = new Set(existing.map((r) => r.id));
+    resource.addMetadata('cdk_nag', { rules_to_suppress: [...existing, ...rules.filter((id) => !ids.has(id)).map((id) => ({ id, reason }))] });
+}
+function list(value) {
+    return value === undefined ? [] : Array.isArray(value) ? value : [value];
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmFnLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3ByaXZhdGUvbmFnLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBVUEsa0RBR0M7QUFPRCx3REFVQztBQUdELGtEQU9DO0FBeENELDZDQUE4RDtBQUM5RCx5REFBMkM7QUFHM0M7Ozs7O0dBS0c7QUFDSCxTQUFnQixtQkFBbUIsQ0FBQyxRQUFxQixFQUFFLEtBQWUsRUFBRSxNQUFjO0lBQ3hGLEtBQUssTUFBTSxJQUFJLElBQUksS0FBSztRQUFFLHlCQUFXLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxFQUFFLEVBQUUsRUFBRSxpQkFBaUIsSUFBSSxFQUFFLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUN4RyxpQkFBaUIsQ0FBQyxRQUFRLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0FBQzdDLENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsU0FBZ0Isc0JBQXNCLENBQUMsUUFBcUIsRUFBRSxNQUFjLEVBQUUsVUFBeUMsRUFBRTtJQUN2SCxpQkFBaUIsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxtQkFBbUIsRUFBRSxHQUFHLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3RILFFBQVEsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDO1FBQzFCLFFBQVEsRUFBRSxHQUFHLEVBQUU7WUFDYixLQUFLLE1BQU0sT0FBTyxJQUFJLFdBQVcsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLGVBQWUsSUFBSSxLQUFLLENBQUMsRUFBRSxDQUFDO2dCQUM5RSx5QkFBVyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxXQUFXLENBQUMsRUFBRSxFQUFFLEVBQUUsaUJBQWlCLE9BQU8sRUFBRSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7WUFDbkYsQ0FBQztZQUNELE9BQU8sRUFBRSxDQUFDO1FBQ1osQ0FBQztLQUNGLENBQUMsQ0FBQztBQUNMLENBQUM7QUFFRCxtSEFBbUg7QUFDbkgsU0FBZ0IsbUJBQW1CLENBQUMsS0FBaUIsRUFBRSxNQUFjLEVBQUUsY0FBd0MsRUFBRTtJQUMvRyxLQUFLLE1BQU0sS0FBSyxJQUFJLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUN6QyxJQUFJLENBQUMseUJBQVcsQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDO1lBQUUsU0FBUztRQUNoRCxJQUFJLEtBQUssWUFBWSxHQUFHLENBQUMsT0FBTyxJQUFJLEtBQUssWUFBWSxHQUFHLENBQUMsU0FBUztZQUFFLHNCQUFzQixDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsRUFBRSxlQUFlLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUNySSxNQUFNLEtBQUssR0FBRyxXQUFXLENBQUMsS0FBSyxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQ2pELElBQUksS0FBSztZQUFFLG1CQUFtQixDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDdkQsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLFdBQVcsQ0FBQyxRQUFxQixFQUFFLGVBQXdCO0lBQ2xFLE1BQU0sS0FBSyxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2pDLE1BQU0sU0FBUyxHQUFVLEVBQUUsQ0FBQztJQUM1QixNQUFNLFFBQVEsR0FBYSxFQUFFLENBQUM7SUFDOUIsSUFBSSxRQUFRLFlBQVksR0FBRyxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ3RDLFNBQVMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQztJQUN6RCxDQUFDO1NBQU0sSUFBSSxRQUFRLFlBQVksR0FBRyxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQzNDLEtBQUssTUFBTSxNQUFNLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRTtZQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUM7UUFDakksSUFBSSxlQUFlLEVBQUUsQ0FBQztZQUNwQixLQUFLLE1BQU0sR0FBRyxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLGlCQUFpQixDQUFDLElBQUksRUFBRTtnQkFBRSxRQUFRLENBQUMsSUFBSSxDQUFDLDZCQUE2QixPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2pJLENBQUM7SUFDSCxDQUFDO0lBQ0QsS0FBSyxNQUFNLFFBQVEsSUFBSSxTQUFTLEVBQUUsQ0FBQztRQUNqQyxLQUFLLE1BQU0sU0FBUyxJQUFJLFFBQVEsRUFBRSxTQUFTLElBQUksRUFBRSxFQUFFLENBQUM7WUFDbEQsSUFBSSxTQUFTLENBQUMsTUFBTSxLQUFLLE9BQU87Z0JBQUUsU0FBUztZQUMzQyxLQUFLLE1BQU0sTUFBTSxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDO2dCQUFFLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7b0JBQUUsUUFBUSxDQUFDLElBQUksQ0FBQyw2QkFBNkIsTUFBTSxHQUFHLENBQUMsQ0FBQztZQUNySSxLQUFLLE1BQU0sQ0FBQyxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztnQkFDekMsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDO2dCQUN4QixJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDO29CQUFFLFFBQVEsQ0FBQyxJQUFJLENBQUMsK0JBQStCLElBQUksR0FBRyxDQUFDLENBQUM7WUFDaEYsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztBQUNoQyxDQUFDO0FBRUQsNEdBQTRHO0FBQzVHLFNBQVMsT0FBTyxDQUFDLElBQVM7SUFDeEIsSUFBSSxJQUFJLEtBQUssU0FBUztRQUFFLE9BQU8sRUFBRSxDQUFDO0lBQ2xDLElBQUksT0FBTyxJQUFJLEtBQUssUUFBUTtRQUFFLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsR0FBRyxDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsQ0FBQztJQUNuRixJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ3JCLE1BQU0sQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQzVDLE9BQU8sS0FBSyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUNELElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUFFLE9BQU8sT0FBTyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO0lBQ3JELElBQUksSUFBSSxDQUFDLFlBQVksQ0FBQztRQUFFLE9BQU8sSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUM7SUFDdkcsSUFBSSxJQUFJLENBQUMsaUJBQWlCLENBQUM7UUFBRSxPQUFPLE9BQU8sQ0FBQyxJQUFJLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDO0lBQ3JFLElBQUksSUFBSSxDQUFDLEdBQUc7UUFBRSxPQUFPLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDO0lBQzlDLE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQztBQUM5QixDQUFDO0FBRUQsU0FBUyxpQkFBaUIsQ0FBQyxRQUFxQixFQUFFLEtBQWUsRUFBRSxNQUFjO0lBQy9FLE1BQU0sUUFBUSxHQUFJLFFBQVEsQ0FBQyxXQUFXLENBQUMsU0FBUyxDQUEwRSxFQUFFLGlCQUFpQixJQUFJLEVBQUUsQ0FBQztJQUNwSixNQUFNLEdBQUcsR0FBRyxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUMvQyxRQUFRLENBQUMsV0FBVyxDQUFDLFNBQVMsRUFBRSxFQUFFLGlCQUFpQixFQUFFLENBQUMsR0FBRyxRQUFRLEVBQUUsR0FBRyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBQzdJLENBQUM7QUFFRCxTQUFTLElBQUksQ0FBQyxLQUFjO0lBQzFCLE9BQU8sS0FBSyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDM0UsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENmblJlc291cmNlLCBTdGFjaywgVmFsaWRhdGlvbnMgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWlhbSc7XG5pbXBvcnQgdHlwZSB7IElDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcblxuLyoqXG4gKiBBY2tub3dsZWRnZXMgY2RrLW5hZyBBd3NTb2x1dGlvbnMgZmluZGluZ3Mgb24gcmVzb3VyY2VzIHRoaXMgbGlicmFyeSBjcmVhdGVzLCBzbyB0ZWFtcyB0aGF0IHJ1biBjZGstbmFnIGRvbid0IGhhdmVcbiAqIHRvIGFja25vd2xlZGdlIG91ciBpbnRlcm5hbHMuIFdyaXR0ZW4gZm9yIGJvdGggbWFqb3IgdmVyc2lvbnMsIHdpdGhvdXQgZGVwZW5kaW5nIG9uIGNkay1uYWc6XG4gKiAtIGNkay1uYWcgMyByZWFkcyBDREsncyBgVmFsaWRhdGlvbnMub2YocmVzb3VyY2UpLmFja25vd2xlZGdlKClgLCBvbmUgaWQgcGVyIGZpbmRpbmcgKGBBd3NTb2x1dGlvbnM6OjxydWxlPls8ZmluZGluZz5dYCk7XG4gKiAtIGNkay1uYWcgMiByZWFkcyBgY2RrX25hZ2AgbWV0YWRhdGEsIHdoZXJlIGEgcnVsZSB3aXRob3V0IGBhcHBsaWVzX3RvYCBjb3ZlcnMgYWxsIGl0cyBmaW5kaW5ncy5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGFja25vd2xlZGdlTmFnUnVsZXMocmVzb3VyY2U6IENmblJlc291cmNlLCBydWxlczogc3RyaW5nW10sIHJlYXNvbjogc3RyaW5nKTogdm9pZCB7XG4gIGZvciAoY29uc3QgcnVsZSBvZiBydWxlcykgVmFsaWRhdGlvbnMub2YocmVzb3VyY2UpLmFja25vd2xlZGdlKHsgaWQ6IGBBd3NTb2x1dGlvbnM6OiR7cnVsZX1gLCByZWFzb24gfSk7XG4gIGFkZFYyU3VwcHJlc3Npb25zKHJlc291cmNlLCBydWxlcywgcmVhc29uKTtcbn1cblxuLyoqXG4gKiBBY2tub3dsZWRnZXMgdGhlIElBTSBmaW5kaW5ncyBvZiBhIHJvbGUgb3IgcG9saWN5IHdob3NlIHBlcm1pc3Npb25zIGFyZSBhbGwgdGhpcyBsaWJyYXJ5J3M6IHdpbGRjYXJkcyAoSUFNNSkgYW5kLFxuICogd2l0aCBgbWFuYWdlZFBvbGljaWVzYCwgQVdTIG1hbmFnZWQgcG9saWNpZXMgKElBTTQpLiBGaW5kaW5nIGlkcyBkZXBlbmQgb24gdGhlIHJlc29sdmVkIHBvbGljeSAobG9naWNhbCBJRHMsIHRoZVxuICogc3RhY2sncyBlbnZpcm9ubWVudCksIHNvIHRoZXkncmUgY29tcHV0ZWQgd2hlbiB0aGUgYXBwIGlzIHN5bnRoZXNpemVkLlxuICovXG5leHBvcnQgZnVuY3Rpb24gYWNrbm93bGVkZ2VJYW1GaW5kaW5ncyhyZXNvdXJjZTogQ2ZuUmVzb3VyY2UsIHJlYXNvbjogc3RyaW5nLCBvcHRpb25zOiB7IG1hbmFnZWRQb2xpY2llcz86IGJvb2xlYW4gfSA9IHt9KTogdm9pZCB7XG4gIGFkZFYyU3VwcHJlc3Npb25zKHJlc291cmNlLCBbJ0F3c1NvbHV0aW9ucy1JQU01JywgLi4uKG9wdGlvbnMubWFuYWdlZFBvbGljaWVzID8gWydBd3NTb2x1dGlvbnMtSUFNNCddIDogW10pXSwgcmVhc29uKTtcbiAgcmVzb3VyY2Uubm9kZS5hZGRWYWxpZGF0aW9uKHtcbiAgICB2YWxpZGF0ZTogKCkgPT4ge1xuICAgICAgZm9yIChjb25zdCBmaW5kaW5nIG9mIGlhbUZpbmRpbmdzKHJlc291cmNlLCBvcHRpb25zLm1hbmFnZWRQb2xpY2llcyA/PyBmYWxzZSkpIHtcbiAgICAgICAgVmFsaWRhdGlvbnMub2YocmVzb3VyY2UpLmFja25vd2xlZGdlKHsgaWQ6IGBBd3NTb2x1dGlvbnM6OiR7ZmluZGluZ31gLCByZWFzb24gfSk7XG4gICAgICB9XG4gICAgICByZXR1cm4gW107XG4gICAgfSxcbiAgfSk7XG59XG5cbi8qKiBBY2tub3dsZWRnZXMgSUFNIGZpbmRpbmdzIG9uIGV2ZXJ5IHJvbGUgYW5kIHBvbGljeSB1bmRlciBgc2NvcGVgLCBhbmQgdGhlIGdpdmVuIHJ1bGVzIG9uIG1hdGNoaW5nIHJlc291cmNlcy4gKi9cbmV4cG9ydCBmdW5jdGlvbiBhY2tub3dsZWRnZU5hZ1VuZGVyKHNjb3BlOiBJQ29uc3RydWN0LCByZWFzb246IHN0cmluZywgcnVsZXNCeVR5cGU6IFJlY29yZDxzdHJpbmcsIHN0cmluZ1tdPiA9IHt9KTogdm9pZCB7XG4gIGZvciAoY29uc3QgY2hpbGQgb2Ygc2NvcGUubm9kZS5maW5kQWxsKCkpIHtcbiAgICBpZiAoIUNmblJlc291cmNlLmlzQ2ZuUmVzb3VyY2UoY2hpbGQpKSBjb250aW51ZTtcbiAgICBpZiAoY2hpbGQgaW5zdGFuY2VvZiBpYW0uQ2ZuUm9sZSB8fCBjaGlsZCBpbnN0YW5jZW9mIGlhbS5DZm5Qb2xpY3kpIGFja25vd2xlZGdlSWFtRmluZGluZ3MoY2hpbGQsIHJlYXNvbiwgeyBtYW5hZ2VkUG9saWNpZXM6IHRydWUgfSk7XG4gICAgY29uc3QgcnVsZXMgPSBydWxlc0J5VHlwZVtjaGlsZC5jZm5SZXNvdXJjZVR5cGVdO1xuICAgIGlmIChydWxlcykgYWNrbm93bGVkZ2VOYWdSdWxlcyhjaGlsZCwgcnVsZXMsIHJlYXNvbik7XG4gIH1cbn1cblxuZnVuY3Rpb24gaWFtRmluZGluZ3MocmVzb3VyY2U6IENmblJlc291cmNlLCBtYW5hZ2VkUG9saWNpZXM6IGJvb2xlYW4pOiBzdHJpbmdbXSB7XG4gIGNvbnN0IHN0YWNrID0gU3RhY2sub2YocmVzb3VyY2UpO1xuICBjb25zdCBkb2N1bWVudHM6IGFueVtdID0gW107XG4gIGNvbnN0IGZpbmRpbmdzOiBzdHJpbmdbXSA9IFtdO1xuICBpZiAocmVzb3VyY2UgaW5zdGFuY2VvZiBpYW0uQ2ZuUG9saWN5KSB7XG4gICAgZG9jdW1lbnRzLnB1c2goc3RhY2sucmVzb2x2ZShyZXNvdXJjZS5wb2xpY3lEb2N1bWVudCkpO1xuICB9IGVsc2UgaWYgKHJlc291cmNlIGluc3RhbmNlb2YgaWFtLkNmblJvbGUpIHtcbiAgICBmb3IgKGNvbnN0IHBvbGljeSBvZiBzdGFjay5yZXNvbHZlKHJlc291cmNlLnBvbGljaWVzKSA/PyBbXSkgZG9jdW1lbnRzLnB1c2goc3RhY2sucmVzb2x2ZShzdGFjay5yZXNvbHZlKHBvbGljeSkucG9saWN5RG9jdW1lbnQpKTtcbiAgICBpZiAobWFuYWdlZFBvbGljaWVzKSB7XG4gICAgICBmb3IgKGNvbnN0IGFybiBvZiBzdGFjay5yZXNvbHZlKHJlc291cmNlLm1hbmFnZWRQb2xpY3lBcm5zKSA/PyBbXSkgZmluZGluZ3MucHVzaChgQXdzU29sdXRpb25zLUlBTTRbUG9saWN5Ojoke2ZsYXR0ZW4oYXJuKX1dYCk7XG4gICAgfVxuICB9XG4gIGZvciAoY29uc3QgZG9jdW1lbnQgb2YgZG9jdW1lbnRzKSB7XG4gICAgZm9yIChjb25zdCBzdGF0ZW1lbnQgb2YgZG9jdW1lbnQ/LlN0YXRlbWVudCA/PyBbXSkge1xuICAgICAgaWYgKHN0YXRlbWVudC5FZmZlY3QgIT09ICdBbGxvdycpIGNvbnRpbnVlO1xuICAgICAgZm9yIChjb25zdCBhY3Rpb24gb2YgbGlzdChzdGF0ZW1lbnQuQWN0aW9uKSkgaWYgKFN0cmluZyhhY3Rpb24pLmluY2x1ZGVzKCcqJykpIGZpbmRpbmdzLnB1c2goYEF3c1NvbHV0aW9ucy1JQU01W0FjdGlvbjo6JHthY3Rpb259XWApO1xuICAgICAgZm9yIChjb25zdCByIG9mIGxpc3Qoc3RhdGVtZW50LlJlc291cmNlKSkge1xuICAgICAgICBjb25zdCBmbGF0ID0gZmxhdHRlbihyKTtcbiAgICAgICAgaWYgKGZsYXQuaW5jbHVkZXMoJyonKSkgZmluZGluZ3MucHVzaChgQXdzU29sdXRpb25zLUlBTTVbUmVzb3VyY2U6OiR7ZmxhdH1dYCk7XG4gICAgICB9XG4gICAgfVxuICB9XG4gIHJldHVybiBbLi4ubmV3IFNldChmaW5kaW5ncyldO1xufVxuXG4vKiogY2RrLW5hZydzIG93biBmbGF0dGVuaW5nIG9mIENsb3VkRm9ybWF0aW9uIHJlZmVyZW5jZXMgaW4gZmluZGluZyBpZHMgKGB1dGlscy9mbGF0dGVuLWNmbi1yZWZlcmVuY2VgKS4gKi9cbmZ1bmN0aW9uIGZsYXR0ZW4obm9kZTogYW55KTogc3RyaW5nIHtcbiAgaWYgKG5vZGUgPT09IHVuZGVmaW5lZCkgcmV0dXJuICcnO1xuICBpZiAodHlwZW9mIG5vZGUgPT09ICdzdHJpbmcnKSByZXR1cm4gbm9kZS5yZXBsYWNlKC9cXCRcXHsvZywgJzwnKS5yZXBsYWNlKC99L2csICc+Jyk7XG4gIGlmIChub2RlWydGbjo6Sm9pbiddKSB7XG4gICAgY29uc3QgW2RlbGltaXRlciwgaXRlbXNdID0gbm9kZVsnRm46OkpvaW4nXTtcbiAgICByZXR1cm4gaXRlbXMubWFwKGZsYXR0ZW4pLmpvaW4oZGVsaW1pdGVyKTtcbiAgfVxuICBpZiAobm9kZVsnRm46OlN1YiddKSByZXR1cm4gZmxhdHRlbihub2RlWydGbjo6U3ViJ10pO1xuICBpZiAobm9kZVsnRm46OkdldEF0dCddKSByZXR1cm4gYDwke2ZsYXR0ZW4obm9kZVsnRm46OkdldEF0dCddWzBdKX0uJHtmbGF0dGVuKG5vZGVbJ0ZuOjpHZXRBdHQnXVsxXSl9PmA7XG4gIGlmIChub2RlWydGbjo6SW1wb3J0VmFsdWUnXSkgcmV0dXJuIGZsYXR0ZW4obm9kZVsnRm46OkltcG9ydFZhbHVlJ10pO1xuICBpZiAobm9kZS5SZWYpIHJldHVybiBgPCR7ZmxhdHRlbihub2RlLlJlZil9PmA7XG4gIHJldHVybiBKU09OLnN0cmluZ2lmeShub2RlKTtcbn1cblxuZnVuY3Rpb24gYWRkVjJTdXBwcmVzc2lvbnMocmVzb3VyY2U6IENmblJlc291cmNlLCBydWxlczogc3RyaW5nW10sIHJlYXNvbjogc3RyaW5nKTogdm9pZCB7XG4gIGNvbnN0IGV4aXN0aW5nID0gKHJlc291cmNlLmdldE1ldGFkYXRhKCdjZGtfbmFnJykgYXMgeyBydWxlc190b19zdXBwcmVzcz86IHsgaWQ6IHN0cmluZzsgcmVhc29uOiBzdHJpbmcgfVtdIH0gfCB1bmRlZmluZWQpPy5ydWxlc190b19zdXBwcmVzcyA/PyBbXTtcbiAgY29uc3QgaWRzID0gbmV3IFNldChleGlzdGluZy5tYXAoKHIpID0+IHIuaWQpKTtcbiAgcmVzb3VyY2UuYWRkTWV0YWRhdGEoJ2Nka19uYWcnLCB7IHJ1bGVzX3RvX3N1cHByZXNzOiBbLi4uZXhpc3RpbmcsIC4uLnJ1bGVzLmZpbHRlcigoaWQpID0+ICFpZHMuaGFzKGlkKSkubWFwKChpZCkgPT4gKHsgaWQsIHJlYXNvbiB9KSldIH0pO1xufVxuXG5mdW5jdGlvbiBsaXN0KHZhbHVlOiB1bmtub3duKTogdW5rbm93bltdIHtcbiAgcmV0dXJuIHZhbHVlID09PSB1bmRlZmluZWQgPyBbXSA6IEFycmF5LmlzQXJyYXkodmFsdWUpID8gdmFsdWUgOiBbdmFsdWVdO1xufVxuIl19

package/lib/private/provider-protocol.d.ts

@@ -110,3 +110,18 @@ export declare const EMPTY_ON_DELETE_TAG: {
 export interface CodeBucketCleanupProperties {
     readonly BucketName: string;
 }
+/**
+ * Writes one stack's statements into a Web Function's resource policy, keeping every other writer's statements
+ * (Web Functions have no AddPermission: the policy is a single document, so writers merge into it).
+ */
+export declare const RESOURCE_POLICY_STATEMENTS_RESOURCE_TYPE = "Custom::LambdaWebResourcePolicyStatements";
+export interface ResourcePolicyStatementsProperties {
+    readonly FunctionArn: string;
+    /** The statements this resource owns, each with a Sid unique in the function's policy. */
+    readonly Policy: {
+        readonly Statement: ReadonlyArray<{
+            readonly Sid: string;
+            readonly [key: string]: unknown;
+        }>;
+    };
+}

package/lib/private/provider-protocol.js

@@ -7,7 +7,7 @@
  * CloudFormation passes every scalar property to the handler as a string.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EMPTY_ON_DELETE_TAG = exports.CODE_BUCKET_CLEANUP_RESOURCE_TYPE = exports.REGIONAL_ALARM_RESOURCE_TYPE = exports.ALARM_NAME_PREFIX = exports.TRAFFIC_SHIFT_RESOURCE_TYPE = exports.REVISION_CLEANUP_RESOURCE_TYPE = exports.ENDPOINT_LOOKUP_RESOURCE_TYPE = exports.LOG_GROUP_RESOURCE_TYPE = exports.CODE_RESOURCE_TYPE = void 0;
+exports.RESOURCE_POLICY_STATEMENTS_RESOURCE_TYPE = exports.EMPTY_ON_DELETE_TAG = exports.CODE_BUCKET_CLEANUP_RESOURCE_TYPE = exports.REGIONAL_ALARM_RESOURCE_TYPE = exports.ALARM_NAME_PREFIX = exports.TRAFFIC_SHIFT_RESOURCE_TYPE = exports.REVISION_CLEANUP_RESOURCE_TYPE = exports.ENDPOINT_LOOKUP_RESOURCE_TYPE = exports.LOG_GROUP_RESOURCE_TYPE = exports.CODE_RESOURCE_TYPE = void 0;
 exports.regionalDomainAttribute = regionalDomainAttribute;
 /** Copies a code zip into the stack's code bucket and returns the object's version. */
 exports.CODE_RESOURCE_TYPE = 'Custom::LambdaWebCode';
@@ -37,4 +37,9 @@ exports.CODE_BUCKET_CLEANUP_RESOURCE_TYPE = 'Custom::LambdaWebCodeBucketCleanup'
  * resources the failed update created, so a cleanup resource added to an existing bucket never empties it on rollback.
  */
 exports.EMPTY_ON_DELETE_TAG = { key: 'cdk-lambda-web:empty-on-delete', value: 'true' };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvdmlkZXItcHJvdG9jb2wuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcHJpdmF0ZS9wcm92aWRlci1wcm90b2NvbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiO0FBQUE7Ozs7OztHQU1HOzs7QUEyQ0gsMERBRUM7QUEzQ0QsdUZBQXVGO0FBQzFFLFFBQUEsa0JBQWtCLEdBQUcsdUJBQXVCLENBQUM7QUFjMUQsdUdBQXVHO0FBQzFGLFFBQUEsdUJBQXVCLEdBQUcsMkJBQTJCLENBQUM7QUFjbkUsZ0hBQWdIO0FBQ25HLFFBQUEsNkJBQTZCLEdBQUcsaUNBQWlDLENBQUM7QUFTL0UsZ0ZBQWdGO0FBQ2hGLFNBQWdCLHVCQUF1QixDQUFDLE1BQWM7SUFDcEQsT0FBTyxVQUFVLE1BQU0sRUFBRSxDQUFDO0FBQzVCLENBQUM7QUFFRCxtSEFBbUg7QUFDdEcsUUFBQSw4QkFBOEIsR0FBRyxrQ0FBa0MsQ0FBQztBQWFqRjs7O0dBR0c7QUFDVSxRQUFBLDJCQUEyQixHQUFHLCtCQUErQixDQUFDO0FBMkIzRSxrSEFBa0g7QUFDbEgsaUhBQWlIO0FBQ3BHLFFBQUEsaUJBQWlCLEdBQUcsWUFBWSxDQUFDO0FBQ2pDLFFBQUEsNEJBQTRCLEdBQUcsd0JBQXdCLENBQUM7QUFnQnJFLDBHQUEwRztBQUM3RixRQUFBLGlDQUFpQyxHQUFHLG9DQUFvQyxDQUFDO0FBRXRGOzs7R0FHRztBQUNVLFFBQUEsbUJBQW1CLEdBQUcsRUFBRSxHQUFHLEVBQUUsZ0NBQWdDLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBDb250cmFjdCBiZXR3ZWVuIHRoZSBjb25zdHJ1Y3RzIGFuZCB0aGUgY3VzdG9tIHJlc291cmNlIGhhbmRsZXIgaW5cbiAqIGBoYW5kbGVycy93ZWItZnVuY3Rpb24tcHJvdmlkZXJgLiBCb3RoIHNpZGVzIGltcG9ydCB0aGlzIGZpbGUsIHNvIHJlc291cmNlXG4gKiB0eXBlcyBhbmQgcHJvcGVydHkgbmFtZXMgY2FuJ3QgZHJpZnQgYXBhcnQuXG4gKlxuICogQ2xvdWRGb3JtYXRpb24gcGFzc2VzIGV2ZXJ5IHNjYWxhciBwcm9wZXJ0eSB0byB0aGUgaGFuZGxlciBhcyBhIHN0cmluZy5cbiAqL1xuXG4vKiogQ29waWVzIGEgY29kZSB6aXAgaW50byB0aGUgc3RhY2sncyBjb2RlIGJ1Y2tldCBhbmQgcmV0dXJucyB0aGUgb2JqZWN0J3MgdmVyc2lvbi4gKi9cbmV4cG9ydCBjb25zdCBDT0RFX1JFU09VUkNFX1RZUEUgPSAnQ3VzdG9tOjpMYW1iZGFXZWJDb2RlJztcblxuZXhwb3J0IGludGVyZmFjZSBDb2RlUHJvcGVydGllcyB7XG4gIHJlYWRvbmx5IFNvdXJjZUJ1Y2tldDogc3RyaW5nO1xuICByZWFkb25seSBTb3VyY2VLZXk6IHN0cmluZztcbiAgcmVhZG9ubHkgU291cmNlVmVyc2lvbj86IHN0cmluZztcbiAgcmVhZG9ubHkgRGVzdGluYXRpb25CdWNrZXQ6IHN0cmluZztcbiAgcmVhZG9ubHkgRGVzdGluYXRpb25LZXk6IHN0cmluZztcbn1cblxuZXhwb3J0IGludGVyZmFjZSBDb2RlQXR0cmlidXRlcyB7XG4gIHJlYWRvbmx5IFZlcnNpb25JZDogc3RyaW5nO1xufVxuXG4vKiogRW5zdXJlcyBvbmUgbG9nIGdyb3VwIChpbiBhbnkgcmVnaW9uKSBleGlzdHMgd2l0aCB0aGUgZ2l2ZW4gcmV0ZW50aW9uLCBhbmQgcmVtb3ZlcyBpdCBvbiBkZWxldGUuICovXG5leHBvcnQgY29uc3QgTE9HX0dST1VQX1JFU09VUkNFX1RZUEUgPSAnQ3VzdG9tOjpMYW1iZGFXZWJMb2dHcm91cCc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgTG9nR3JvdXBQcm9wZXJ0aWVzIHtcbiAgcmVhZG9ubHkgUmVnaW9uOiBzdHJpbmc7XG4gIHJlYWRvbmx5IExvZ0dyb3VwTmFtZTogc3RyaW5nO1xuICAvKiogRGF5cywgb3IgJ0luZmluaXRlJyBmb3Igbm8gcmV0ZW50aW9uLiAqL1xuICByZWFkb25seSBSZXRlbnRpb25JbkRheXM6IHN0cmluZztcbiAgcmVhZG9ubHkgUmVtb3ZhbFBvbGljeTogJ3JldGFpbicgfCAnZGVzdHJveSc7XG4gIC8qKiBTZWNvbmRzIHRvIHdhaXQgYmVmb3JlIGRlbGV0aW5nLCBzbyBlbnZpcm9ubWVudHMgc3RpbGwgc2h1dHRpbmcgZG93biBjYW4gZmx1c2ggdGhlaXIgbGFzdCBsaW5lcy4gKi9cbiAgcmVhZG9ubHkgRmx1c2hXYWl0U2Vjb25kczogc3RyaW5nO1xuICAvKiogU2Vjb25kcyB0byB3YWl0IGJlZm9yZSBjaGVja2luZyBvbmNlIG1vcmUgdGhhdCB0aGUgc2VydmljZSBoYXNuJ3QgcmUtY3JlYXRlZCB0aGUgZ3JvdXAuICovXG4gIHJlYWRvbmx5IFJlY2hlY2tXYWl0U2Vjb25kczogc3RyaW5nO1xufVxuXG4vKiogUmVhZHMgYW4gZW5kcG9pbnQncyBwZXItcmVnaW9uIGRvbWFpbiBuYW1lcywgd2hpY2ggQ2xvdWRGb3JtYXRpb24gY2FuJ3QgaW5kZXggb3V0IG9mIGBSZWdpb25hbEVuZHBvaW50c2AuICovXG5leHBvcnQgY29uc3QgRU5EUE9JTlRfTE9PS1VQX1JFU09VUkNFX1RZUEUgPSAnQ3VzdG9tOjpMYW1iZGFXZWJFbmRwb2ludExvb2t1cCc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgRW5kcG9pbnRMb29rdXBQcm9wZXJ0aWVzIHtcbiAgcmVhZG9ubHkgRnVuY3Rpb25Bcm46IHN0cmluZztcbiAgcmVhZG9ubHkgRW5kcG9pbnROYW1lOiBzdHJpbmc7XG4gIC8qKiBDaGFuZ2VzIHdoZW5ldmVyIHRoZSBlbmRwb2ludCBpcyByZXBsYWNlZCwgc28gdGhlIGxvb2t1cCBydW5zIGFnYWluLiAqL1xuICByZWFkb25seSBFbmRwb2ludEFybjogc3RyaW5nO1xufVxuXG4vKiogQXR0cmlidXRlIG5hbWUgaG9sZGluZyB0aGUgZG9tYWluIG9mIG9uZSByZWdpb24sIGUuZy4gYERvbWFpbi51cy1lYXN0LTFgLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHJlZ2lvbmFsRG9tYWluQXR0cmlidXRlKHJlZ2lvbjogc3RyaW5nKTogc3RyaW5nIHtcbiAgcmV0dXJuIGBEb21haW4uJHtyZWdpb259YDtcbn1cblxuLyoqIERlbGV0ZXMgYSBmdW5jdGlvbidzIG9sZGVzdCByZXZpc2lvbnMgYmV5b25kIGEgY291bnQsIGV4Y2VwdCB0aG9zZSB0aGF0IGFyZSBpbiB1c2Ugb3IgbWF5IGJlIHJvbGxlZCBiYWNrIHRvLiAqL1xuZXhwb3J0IGNvbnN0IFJFVklTSU9OX0NMRUFOVVBfUkVTT1VSQ0VfVFlQRSA9ICdDdXN0b206OkxhbWJkYVdlYlJldmlzaW9uQ2xlYW51cCc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgUmV2aXNpb25DbGVhbnVwUHJvcGVydGllcyB7XG4gIHJlYWRvbmx5IEZ1bmN0aW9uQXJuOiBzdHJpbmc7XG4gIC8qKiBIb3cgbWFueSBvZiB0aGUgbmV3ZXN0IHJldmlzaW9ucyB0byBrZWVwLiAqL1xuICByZWFkb25seSBLZWVwOiBzdHJpbmc7XG4gIC8qKlxuICAgKiBSZXZpc2lvbnMgdGhlIHRlbXBsYXRlIHVzZXMgKHRoZSBjdXJyZW50IG9uZSBhbmQgYW55IGFuIGVuZHBvaW50IHJvdXRlcyB0bykuIEFsd2F5cyBrZXB0LCBhbmQgb24gYW4gdXBkYXRlXG4gICAqIHRoZSBwcmV2aW91cyB0ZW1wbGF0ZSdzIGFyZSBrZXB0IHRvbzogdGhleSdyZSB3aGF0IGEgcm9sbGJhY2sgcm91dGVzIGJhY2sgdG8uXG4gICAqL1xuICByZWFkb25seSBSZXZpc2lvbklkczogc3RyaW5nW107XG59XG5cbi8qKlxuICogTW92ZXMgYW4gZW5kcG9pbnQncyB0cmFmZmljIHRvIGEgcmV2aXNpb24gaW4gc3RlcHMsIHdhdGNoaW5nIGFsYXJtcyAoY2FuYXJ5IGFuZCBsaW5lYXIgZGVwbG95bWVudHMpLlxuICogU2VydmVkIGJ5IHRoZSBkZXBsb3ltZW50IHByb3ZpZGVyIChgaGFuZGxlcnMvd2ViLWZ1bmN0aW9uLWRlcGxveW1lbnRgKSwgbm90IHRoZSBzaGFyZWQgcHJvdmlkZXI6IGl0IGNhbiBydW4gZm9yIHVwIHRvIGFuIGhvdXIuXG4gKi9cbmV4cG9ydCBjb25zdCBUUkFGRklDX1NISUZUX1JFU09VUkNFX1RZUEUgPSAnQ3VzdG9tOjpMYW1iZGFXZWJUcmFmZmljU2hpZnQnO1xuXG5leHBvcnQgaW50ZXJmYWNlIFRyYWZmaWNTaGlmdFByb3BlcnRpZXMge1xuICByZWFkb25seSBGdW5jdGlvbkFybjogc3RyaW5nO1xuICByZWFkb25seSBFbmRwb2ludE5hbWU6IHN0cmluZztcbiAgLyoqIFRoZSByZXZpc2lvbiB0aGF0IGVuZHMgdXAgd2l0aCBhbGwgb2YgdGhlIGVuZHBvaW50J3MgdHJhZmZpYy4gKi9cbiAgcmVhZG9ubHkgUmV2aXNpb25JZDogc3RyaW5nO1xuICAvKiogVGhlIHJldmlzaW9uJ3Mgc2hhcmUgb2YgdHJhZmZpYyBhdCBlYWNoIHN0ZXAsIGluIHBlcmNlbnQsIGNvbW1hLXNlcGFyYXRlZDsgdGhlIGxhc3QgaXMgMTAwLiAqL1xuICByZWFkb25seSBTdGVwczogc3RyaW5nO1xuICAvKiogU2Vjb25kcyBlYWNoIHN0ZXAgc2VydmVzIChjb3VudGVkIGZyb20gd2hlbiBpdHMgdXBkYXRlIHN0YXJ0ZWQpIGJlZm9yZSB0aGUgbmV4dC4gKi9cbiAgcmVhZG9ubHkgV2FpdFNlY29uZHM6IHN0cmluZztcbiAgLyoqIEFsYXJtcyAoaW4gYW55IHJlZ2lvbikgdGhhdCBzdG9wIHRoZSBkZXBsb3ltZW50IGFuZCByZXN0b3JlIHRoZSBwcmV2aW91cyB3ZWlnaHRzLiAqL1xuICByZWFkb25seSBBbGFybUFybnM/OiBzdHJpbmdbXTtcbiAgLyoqIEhhc2ggb2YgdGhlIGVuZHBvaW50J3Mgb3RoZXIgc2V0dGluZ3M6IGFueSBlbmRwb2ludCBjaGFuZ2UgcmUtY2hlY2tzIGl0cyB0cmFmZmljIGJlZm9yZSBDbG91ZEZvcm1hdGlvbiB3cml0ZXMgaXQuICovXG4gIHJlYWRvbmx5IEVuZHBvaW50Q29uZmlnOiBzdHJpbmc7XG59XG5cbi8qKiBXaGF0IGBvbkV2ZW50YCBoYW5kcyB0byBgaXNDb21wbGV0ZWAgKHRoZSBQcm92aWRlciBmcmFtZXdvcmsgcGFzc2VzIGl0IGFzIGBEYXRhYCkuICovXG5leHBvcnQgaW50ZXJmYWNlIFRyYWZmaWNTaGlmdFN0YXRlIHtcbiAgLyoqIGBub25lYDogbm90aGluZyB0byBkbzsgYHNoaWZ0YDogbW92aW5nIGluIHN0ZXBzOyBgc3dpdGNoYDogYWxsIGF0IG9uY2UsIHdpdGhvdXQgYWxhcm1zIChzdGFjayByb2xsYmFjaykuICovXG4gIHJlYWRvbmx5IEFjdGlvbjogJ25vbmUnIHwgJ3NoaWZ0JyB8ICdzd2l0Y2gnO1xuICAvKiogYHNoaWZ0YDogdGhlIGVuZHBvaW50J3Mgd2VpZ2h0cyBiZWZvcmUgdGhlIGRlcGxveW1lbnQgKEpTT04gYFt7cmV2aXNpb25JZCwgd2VpZ2h0fV1gKSwgcmVzdG9yZWQgd2hlbiBhbiBhbGFybSBmaXJlcy4gKi9cbiAgcmVhZG9ubHkgUHJldmlvdXNXZWlnaHRzPzogc3RyaW5nO1xuICAvKiogYHN3aXRjaGA6IHRoZSB3ZWlnaHRzIGJlaW5nIHdyaXR0ZW4gKEpTT04gYFt7cmV2aXNpb25JZCwgd2VpZ2h0fV1gKS4gKi9cbiAgcmVhZG9ubHkgVGFyZ2V0V2VpZ2h0cz86IHN0cmluZztcbn1cblxuLyoqIENyZWF0ZXMgYSBDbG91ZFdhdGNoIG1ldHJpYyBhbGFybSBpbiBhbnkgcmVnaW9uIChDbG91ZEZvcm1hdGlvbiBvbmx5IGNyZWF0ZXMgYWxhcm1zIGluIHRoZSBzdGFjaydzIHJlZ2lvbikuICovXG4vKiogUHJlZml4IG9mIGV2ZXJ5IGFsYXJtIHRoaXMgbGlicmFyeSBjcmVhdGVzIG91dHNpZGUgdGhlIHN0YWNrJ3MgcmVnaW9uOyB0aGUgcHJvdmlkZXIncyBJQU0gaXMgc2NvcGVkIHRvIGl0LiAqL1xuZXhwb3J0IGNvbnN0IEFMQVJNX05BTUVfUFJFRklYID0gJ0xhbWJkYVdlYi0nO1xuZXhwb3J0IGNvbnN0IFJFR0lPTkFMX0FMQVJNX1JFU09VUkNFX1RZUEUgPSAnQ3VzdG9tOjpMYW1iZGFXZWJBbGFybSc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgUmVnaW9uYWxBbGFybVByb3BlcnRpZXMge1xuICByZWFkb25seSBSZWdpb246IHN0cmluZztcbiAgcmVhZG9ubHkgQWxhcm1OYW1lOiBzdHJpbmc7XG4gIHJlYWRvbmx5IEFsYXJtRGVzY3JpcHRpb246IHN0cmluZztcbiAgLyoqIFB1dE1ldHJpY0FsYXJtJ3MgYE1ldHJpY3NgLCBhcyBKU09OLiAqL1xuICByZWFkb25seSBNZXRyaWNzOiBzdHJpbmc7XG4gIHJlYWRvbmx5IFRocmVzaG9sZDogc3RyaW5nO1xuICByZWFkb25seSBFdmFsdWF0aW9uUGVyaW9kczogc3RyaW5nO1xuICAvKiogUHV0TWV0cmljQWxhcm0ncyBgQ29tcGFyaXNvbk9wZXJhdG9yYC4gKi9cbiAgcmVhZG9ubHkgQ29tcGFyaXNvbk9wZXJhdG9yOiBzdHJpbmc7XG4gIC8qKiBQdXRNZXRyaWNBbGFybSdzIGBUcmVhdE1pc3NpbmdEYXRhYC4gKi9cbiAgcmVhZG9ubHkgVHJlYXRNaXNzaW5nRGF0YTogc3RyaW5nO1xufVxuXG4vKiogRW1wdGllcyB0aGUgc3RhY2sncyBjb2RlIGJ1Y2tldCAoZXZlcnkgb2JqZWN0IHZlcnNpb24gYW5kIGRlbGV0ZSBtYXJrZXIpIHdoZW4gdGhlIHN0YWNrIGRlbGV0ZXMgaXQuICovXG5leHBvcnQgY29uc3QgQ09ERV9CVUNLRVRfQ0xFQU5VUF9SRVNPVVJDRV9UWVBFID0gJ0N1c3RvbTo6TGFtYmRhV2ViQ29kZUJ1Y2tldENsZWFudXAnO1xuXG4vKipcbiAqIFRhZyBvbiB0aGUgY29kZSBidWNrZXQgdGhhdCBsZXRzIHRoZSBjbGVhbnVwIGVtcHR5IGl0LiBBIHJvbGxiYWNrIHJldmVydHMgdGhlIGJ1Y2tldCdzIHRhZ3MgYmVmb3JlIGl0IGRlbGV0ZXNcbiAqIHJlc291cmNlcyB0aGUgZmFpbGVkIHVwZGF0ZSBjcmVhdGVkLCBzbyBhIGNsZWFudXAgcmVzb3VyY2UgYWRkZWQgdG8gYW4gZXhpc3RpbmcgYnVja2V0IG5ldmVyIGVtcHRpZXMgaXQgb24gcm9sbGJhY2suXG4gKi9cbmV4cG9ydCBjb25zdCBFTVBUWV9PTl9ERUxFVEVfVEFHID0geyBrZXk6ICdjZGstbGFtYmRhLXdlYjplbXB0eS1vbi1kZWxldGUnLCB2YWx1ZTogJ3RydWUnIH07XG5cbmV4cG9ydCBpbnRlcmZhY2UgQ29kZUJ1Y2tldENsZWFudXBQcm9wZXJ0aWVzIHtcbiAgcmVhZG9ubHkgQnVja2V0TmFtZTogc3RyaW5nO1xufVxuIl19
+/**
+ * Writes one stack's statements into a Web Function's resource policy, keeping every other writer's statements
+ * (Web Functions have no AddPermission: the policy is a single document, so writers merge into it).
+ */
+exports.RESOURCE_POLICY_STATEMENTS_RESOURCE_TYPE = 'Custom::LambdaWebResourcePolicyStatements';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvdmlkZXItcHJvdG9jb2wuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcHJpdmF0ZS9wcm92aWRlci1wcm90b2NvbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiO0FBQUE7Ozs7OztHQU1HOzs7QUEyQ0gsMERBRUM7QUEzQ0QsdUZBQXVGO0FBQzFFLFFBQUEsa0JBQWtCLEdBQUcsdUJBQXVCLENBQUM7QUFjMUQsdUdBQXVHO0FBQzFGLFFBQUEsdUJBQXVCLEdBQUcsMkJBQTJCLENBQUM7QUFjbkUsZ0hBQWdIO0FBQ25HLFFBQUEsNkJBQTZCLEdBQUcsaUNBQWlDLENBQUM7QUFTL0UsZ0ZBQWdGO0FBQ2hGLFNBQWdCLHVCQUF1QixDQUFDLE1BQWM7SUFDcEQsT0FBTyxVQUFVLE1BQU0sRUFBRSxDQUFDO0FBQzVCLENBQUM7QUFFRCxtSEFBbUg7QUFDdEcsUUFBQSw4QkFBOEIsR0FBRyxrQ0FBa0MsQ0FBQztBQWFqRjs7O0dBR0c7QUFDVSxRQUFBLDJCQUEyQixHQUFHLCtCQUErQixDQUFDO0FBMkIzRSxrSEFBa0g7QUFDbEgsaUhBQWlIO0FBQ3BHLFFBQUEsaUJBQWlCLEdBQUcsWUFBWSxDQUFDO0FBQ2pDLFFBQUEsNEJBQTRCLEdBQUcsd0JBQXdCLENBQUM7QUFnQnJFLDBHQUEwRztBQUM3RixRQUFBLGlDQUFpQyxHQUFHLG9DQUFvQyxDQUFDO0FBRXRGOzs7R0FHRztBQUNVLFFBQUEsbUJBQW1CLEdBQUcsRUFBRSxHQUFHLEVBQUUsZ0NBQWdDLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxDQUFDO0FBTTVGOzs7R0FHRztBQUNVLFFBQUEsd0NBQXdDLEdBQUcsMkNBQTJDLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIENvbnRyYWN0IGJldHdlZW4gdGhlIGNvbnN0cnVjdHMgYW5kIHRoZSBjdXN0b20gcmVzb3VyY2UgaGFuZGxlciBpblxuICogYGhhbmRsZXJzL3dlYi1mdW5jdGlvbi1wcm92aWRlcmAuIEJvdGggc2lkZXMgaW1wb3J0IHRoaXMgZmlsZSwgc28gcmVzb3VyY2VcbiAqIHR5cGVzIGFuZCBwcm9wZXJ0eSBuYW1lcyBjYW4ndCBkcmlmdCBhcGFydC5cbiAqXG4gKiBDbG91ZEZvcm1hdGlvbiBwYXNzZXMgZXZlcnkgc2NhbGFyIHByb3BlcnR5IHRvIHRoZSBoYW5kbGVyIGFzIGEgc3RyaW5nLlxuICovXG5cbi8qKiBDb3BpZXMgYSBjb2RlIHppcCBpbnRvIHRoZSBzdGFjaydzIGNvZGUgYnVja2V0IGFuZCByZXR1cm5zIHRoZSBvYmplY3QncyB2ZXJzaW9uLiAqL1xuZXhwb3J0IGNvbnN0IENPREVfUkVTT1VSQ0VfVFlQRSA9ICdDdXN0b206OkxhbWJkYVdlYkNvZGUnO1xuXG5leHBvcnQgaW50ZXJmYWNlIENvZGVQcm9wZXJ0aWVzIHtcbiAgcmVhZG9ubHkgU291cmNlQnVja2V0OiBzdHJpbmc7XG4gIHJlYWRvbmx5IFNvdXJjZUtleTogc3RyaW5nO1xuICByZWFkb25seSBTb3VyY2VWZXJzaW9uPzogc3RyaW5nO1xuICByZWFkb25seSBEZXN0aW5hdGlvbkJ1Y2tldDogc3RyaW5nO1xuICByZWFkb25seSBEZXN0aW5hdGlvbktleTogc3RyaW5nO1xufVxuXG5leHBvcnQgaW50ZXJmYWNlIENvZGVBdHRyaWJ1dGVzIHtcbiAgcmVhZG9ubHkgVmVyc2lvbklkOiBzdHJpbmc7XG59XG5cbi8qKiBFbnN1cmVzIG9uZSBsb2cgZ3JvdXAgKGluIGFueSByZWdpb24pIGV4aXN0cyB3aXRoIHRoZSBnaXZlbiByZXRlbnRpb24sIGFuZCByZW1vdmVzIGl0IG9uIGRlbGV0ZS4gKi9cbmV4cG9ydCBjb25zdCBMT0dfR1JPVVBfUkVTT1VSQ0VfVFlQRSA9ICdDdXN0b206OkxhbWJkYVdlYkxvZ0dyb3VwJztcblxuZXhwb3J0IGludGVyZmFjZSBMb2dHcm91cFByb3BlcnRpZXMge1xuICByZWFkb25seSBSZWdpb246IHN0cmluZztcbiAgcmVhZG9ubHkgTG9nR3JvdXBOYW1lOiBzdHJpbmc7XG4gIC8qKiBEYXlzLCBvciAnSW5maW5pdGUnIGZvciBubyByZXRlbnRpb24uICovXG4gIHJlYWRvbmx5IFJldGVudGlvbkluRGF5czogc3RyaW5nO1xuICByZWFkb25seSBSZW1vdmFsUG9saWN5OiAncmV0YWluJyB8ICdkZXN0cm95JztcbiAgLyoqIFNlY29uZHMgdG8gd2FpdCBiZWZvcmUgZGVsZXRpbmcsIHNvIGVudmlyb25tZW50cyBzdGlsbCBzaHV0dGluZyBkb3duIGNhbiBmbHVzaCB0aGVpciBsYXN0IGxpbmVzLiAqL1xuICByZWFkb25seSBGbHVzaFdhaXRTZWNvbmRzOiBzdHJpbmc7XG4gIC8qKiBTZWNvbmRzIHRvIHdhaXQgYmVmb3JlIGNoZWNraW5nIG9uY2UgbW9yZSB0aGF0IHRoZSBzZXJ2aWNlIGhhc24ndCByZS1jcmVhdGVkIHRoZSBncm91cC4gKi9cbiAgcmVhZG9ubHkgUmVjaGVja1dhaXRTZWNvbmRzOiBzdHJpbmc7XG59XG5cbi8qKiBSZWFkcyBhbiBlbmRwb2ludCdzIHBlci1yZWdpb24gZG9tYWluIG5hbWVzLCB3aGljaCBDbG91ZEZvcm1hdGlvbiBjYW4ndCBpbmRleCBvdXQgb2YgYFJlZ2lvbmFsRW5kcG9pbnRzYC4gKi9cbmV4cG9ydCBjb25zdCBFTkRQT0lOVF9MT09LVVBfUkVTT1VSQ0VfVFlQRSA9ICdDdXN0b206OkxhbWJkYVdlYkVuZHBvaW50TG9va3VwJztcblxuZXhwb3J0IGludGVyZmFjZSBFbmRwb2ludExvb2t1cFByb3BlcnRpZXMge1xuICByZWFkb25seSBGdW5jdGlvbkFybjogc3RyaW5nO1xuICByZWFkb25seSBFbmRwb2ludE5hbWU6IHN0cmluZztcbiAgLyoqIENoYW5nZXMgd2hlbmV2ZXIgdGhlIGVuZHBvaW50IGlzIHJlcGxhY2VkLCBzbyB0aGUgbG9va3VwIHJ1bnMgYWdhaW4uICovXG4gIHJlYWRvbmx5IEVuZHBvaW50QXJuOiBzdHJpbmc7XG59XG5cbi8qKiBBdHRyaWJ1dGUgbmFtZSBob2xkaW5nIHRoZSBkb21haW4gb2Ygb25lIHJlZ2lvbiwgZS5nLiBgRG9tYWluLnVzLWVhc3QtMWAuICovXG5leHBvcnQgZnVuY3Rpb24gcmVnaW9uYWxEb21haW5BdHRyaWJ1dGUocmVnaW9uOiBzdHJpbmcpOiBzdHJpbmcge1xuICByZXR1cm4gYERvbWFpbi4ke3JlZ2lvbn1gO1xufVxuXG4vKiogRGVsZXRlcyBhIGZ1bmN0aW9uJ3Mgb2xkZXN0IHJldmlzaW9ucyBiZXlvbmQgYSBjb3VudCwgZXhjZXB0IHRob3NlIHRoYXQgYXJlIGluIHVzZSBvciBtYXkgYmUgcm9sbGVkIGJhY2sgdG8uICovXG5leHBvcnQgY29uc3QgUkVWSVNJT05fQ0xFQU5VUF9SRVNPVVJDRV9UWVBFID0gJ0N1c3RvbTo6TGFtYmRhV2ViUmV2aXNpb25DbGVhbnVwJztcblxuZXhwb3J0IGludGVyZmFjZSBSZXZpc2lvbkNsZWFudXBQcm9wZXJ0aWVzIHtcbiAgcmVhZG9ubHkgRnVuY3Rpb25Bcm46IHN0cmluZztcbiAgLyoqIEhvdyBtYW55IG9mIHRoZSBuZXdlc3QgcmV2aXNpb25zIHRvIGtlZXAuICovXG4gIHJlYWRvbmx5IEtlZXA6IHN0cmluZztcbiAgLyoqXG4gICAqIFJldmlzaW9ucyB0aGUgdGVtcGxhdGUgdXNlcyAodGhlIGN1cnJlbnQgb25lIGFuZCBhbnkgYW4gZW5kcG9pbnQgcm91dGVzIHRvKS4gQWx3YXlzIGtlcHQsIGFuZCBvbiBhbiB1cGRhdGVcbiAgICogdGhlIHByZXZpb3VzIHRlbXBsYXRlJ3MgYXJlIGtlcHQgdG9vOiB0aGV5J3JlIHdoYXQgYSByb2xsYmFjayByb3V0ZXMgYmFjayB0by5cbiAgICovXG4gIHJlYWRvbmx5IFJldmlzaW9uSWRzOiBzdHJpbmdbXTtcbn1cblxuLyoqXG4gKiBNb3ZlcyBhbiBlbmRwb2ludCdzIHRyYWZmaWMgdG8gYSByZXZpc2lvbiBpbiBzdGVwcywgd2F0Y2hpbmcgYWxhcm1zIChjYW5hcnkgYW5kIGxpbmVhciBkZXBsb3ltZW50cykuXG4gKiBTZXJ2ZWQgYnkgdGhlIGRlcGxveW1lbnQgcHJvdmlkZXIgKGBoYW5kbGVycy93ZWItZnVuY3Rpb24tZGVwbG95bWVudGApLCBub3QgdGhlIHNoYXJlZCBwcm92aWRlcjogaXQgY2FuIHJ1biBmb3IgdXAgdG8gYW4gaG91ci5cbiAqL1xuZXhwb3J0IGNvbnN0IFRSQUZGSUNfU0hJRlRfUkVTT1VSQ0VfVFlQRSA9ICdDdXN0b206OkxhbWJkYVdlYlRyYWZmaWNTaGlmdCc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgVHJhZmZpY1NoaWZ0UHJvcGVydGllcyB7XG4gIHJlYWRvbmx5IEZ1bmN0aW9uQXJuOiBzdHJpbmc7XG4gIHJlYWRvbmx5IEVuZHBvaW50TmFtZTogc3RyaW5nO1xuICAvKiogVGhlIHJldmlzaW9uIHRoYXQgZW5kcyB1cCB3aXRoIGFsbCBvZiB0aGUgZW5kcG9pbnQncyB0cmFmZmljLiAqL1xuICByZWFkb25seSBSZXZpc2lvbklkOiBzdHJpbmc7XG4gIC8qKiBUaGUgcmV2aXNpb24ncyBzaGFyZSBvZiB0cmFmZmljIGF0IGVhY2ggc3RlcCwgaW4gcGVyY2VudCwgY29tbWEtc2VwYXJhdGVkOyB0aGUgbGFzdCBpcyAxMDAuICovXG4gIHJlYWRvbmx5IFN0ZXBzOiBzdHJpbmc7XG4gIC8qKiBTZWNvbmRzIGVhY2ggc3RlcCBzZXJ2ZXMgKGNvdW50ZWQgZnJvbSB3aGVuIGl0cyB1cGRhdGUgc3RhcnRlZCkgYmVmb3JlIHRoZSBuZXh0LiAqL1xuICByZWFkb25seSBXYWl0U2Vjb25kczogc3RyaW5nO1xuICAvKiogQWxhcm1zIChpbiBhbnkgcmVnaW9uKSB0aGF0IHN0b3AgdGhlIGRlcGxveW1lbnQgYW5kIHJlc3RvcmUgdGhlIHByZXZpb3VzIHdlaWdodHMuICovXG4gIHJlYWRvbmx5IEFsYXJtQXJucz86IHN0cmluZ1tdO1xuICAvKiogSGFzaCBvZiB0aGUgZW5kcG9pbnQncyBvdGhlciBzZXR0aW5nczogYW55IGVuZHBvaW50IGNoYW5nZSByZS1jaGVja3MgaXRzIHRyYWZmaWMgYmVmb3JlIENsb3VkRm9ybWF0aW9uIHdyaXRlcyBpdC4gKi9cbiAgcmVhZG9ubHkgRW5kcG9pbnRDb25maWc6IHN0cmluZztcbn1cblxuLyoqIFdoYXQgYG9uRXZlbnRgIGhhbmRzIHRvIGBpc0NvbXBsZXRlYCAodGhlIFByb3ZpZGVyIGZyYW1ld29yayBwYXNzZXMgaXQgYXMgYERhdGFgKS4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgVHJhZmZpY1NoaWZ0U3RhdGUge1xuICAvKiogYG5vbmVgOiBub3RoaW5nIHRvIGRvOyBgc2hpZnRgOiBtb3ZpbmcgaW4gc3RlcHM7IGBzd2l0Y2hgOiBhbGwgYXQgb25jZSwgd2l0aG91dCBhbGFybXMgKHN0YWNrIHJvbGxiYWNrKS4gKi9cbiAgcmVhZG9ubHkgQWN0aW9uOiAnbm9uZScgfCAnc2hpZnQnIHwgJ3N3aXRjaCc7XG4gIC8qKiBgc2hpZnRgOiB0aGUgZW5kcG9pbnQncyB3ZWlnaHRzIGJlZm9yZSB0aGUgZGVwbG95bWVudCAoSlNPTiBgW3tyZXZpc2lvbklkLCB3ZWlnaHR9XWApLCByZXN0b3JlZCB3aGVuIGFuIGFsYXJtIGZpcmVzLiAqL1xuICByZWFkb25seSBQcmV2aW91c1dlaWdodHM/OiBzdHJpbmc7XG4gIC8qKiBgc3dpdGNoYDogdGhlIHdlaWdodHMgYmVpbmcgd3JpdHRlbiAoSlNPTiBgW3tyZXZpc2lvbklkLCB3ZWlnaHR9XWApLiAqL1xuICByZWFkb25seSBUYXJnZXRXZWlnaHRzPzogc3RyaW5nO1xufVxuXG4vKiogQ3JlYXRlcyBhIENsb3VkV2F0Y2ggbWV0cmljIGFsYXJtIGluIGFueSByZWdpb24gKENsb3VkRm9ybWF0aW9uIG9ubHkgY3JlYXRlcyBhbGFybXMgaW4gdGhlIHN0YWNrJ3MgcmVnaW9uKS4gKi9cbi8qKiBQcmVmaXggb2YgZXZlcnkgYWxhcm0gdGhpcyBsaWJyYXJ5IGNyZWF0ZXMgb3V0c2lkZSB0aGUgc3RhY2sncyByZWdpb247IHRoZSBwcm92aWRlcidzIElBTSBpcyBzY29wZWQgdG8gaXQuICovXG5leHBvcnQgY29uc3QgQUxBUk1fTkFNRV9QUkVGSVggPSAnTGFtYmRhV2ViLSc7XG5leHBvcnQgY29uc3QgUkVHSU9OQUxfQUxBUk1fUkVTT1VSQ0VfVFlQRSA9ICdDdXN0b206OkxhbWJkYVdlYkFsYXJtJztcblxuZXhwb3J0IGludGVyZmFjZSBSZWdpb25hbEFsYXJtUHJvcGVydGllcyB7XG4gIHJlYWRvbmx5IFJlZ2lvbjogc3RyaW5nO1xuICByZWFkb25seSBBbGFybU5hbWU6IHN0cmluZztcbiAgcmVhZG9ubHkgQWxhcm1EZXNjcmlwdGlvbjogc3RyaW5nO1xuICAvKiogUHV0TWV0cmljQWxhcm0ncyBgTWV0cmljc2AsIGFzIEpTT04uICovXG4gIHJlYWRvbmx5IE1ldHJpY3M6IHN0cmluZztcbiAgcmVhZG9ubHkgVGhyZXNob2xkOiBzdHJpbmc7XG4gIHJlYWRvbmx5IEV2YWx1YXRpb25QZXJpb2RzOiBzdHJpbmc7XG4gIC8qKiBQdXRNZXRyaWNBbGFybSdzIGBDb21wYXJpc29uT3BlcmF0b3JgLiAqL1xuICByZWFkb25seSBDb21wYXJpc29uT3BlcmF0b3I6IHN0cmluZztcbiAgLyoqIFB1dE1ldHJpY0FsYXJtJ3MgYFRyZWF0TWlzc2luZ0RhdGFgLiAqL1xuICByZWFkb25seSBUcmVhdE1pc3NpbmdEYXRhOiBzdHJpbmc7XG59XG5cbi8qKiBFbXB0aWVzIHRoZSBzdGFjaydzIGNvZGUgYnVja2V0IChldmVyeSBvYmplY3QgdmVyc2lvbiBhbmQgZGVsZXRlIG1hcmtlcikgd2hlbiB0aGUgc3RhY2sgZGVsZXRlcyBpdC4gKi9cbmV4cG9ydCBjb25zdCBDT0RFX0JVQ0tFVF9DTEVBTlVQX1JFU09VUkNFX1RZUEUgPSAnQ3VzdG9tOjpMYW1iZGFXZWJDb2RlQnVja2V0Q2xlYW51cCc7XG5cbi8qKlxuICogVGFnIG9uIHRoZSBjb2RlIGJ1Y2tldCB0aGF0IGxldHMgdGhlIGNsZWFudXAgZW1wdHkgaXQuIEEgcm9sbGJhY2sgcmV2ZXJ0cyB0aGUgYnVja2V0J3MgdGFncyBiZWZvcmUgaXQgZGVsZXRlc1xuICogcmVzb3VyY2VzIHRoZSBmYWlsZWQgdXBkYXRlIGNyZWF0ZWQsIHNvIGEgY2xlYW51cCByZXNvdXJjZSBhZGRlZCB0byBhbiBleGlzdGluZyBidWNrZXQgbmV2ZXIgZW1wdGllcyBpdCBvbiByb2xsYmFjay5cbiAqL1xuZXhwb3J0IGNvbnN0IEVNUFRZX09OX0RFTEVURV9UQUcgPSB7IGtleTogJ2Nkay1sYW1iZGEtd2ViOmVtcHR5LW9uLWRlbGV0ZScsIHZhbHVlOiAndHJ1ZScgfTtcblxuZXhwb3J0IGludGVyZmFjZSBDb2RlQnVja2V0Q2xlYW51cFByb3BlcnRpZXMge1xuICByZWFkb25seSBCdWNrZXROYW1lOiBzdHJpbmc7XG59XG5cbi8qKlxuICogV3JpdGVzIG9uZSBzdGFjaydzIHN0YXRlbWVudHMgaW50byBhIFdlYiBGdW5jdGlvbidzIHJlc291cmNlIHBvbGljeSwga2VlcGluZyBldmVyeSBvdGhlciB3cml0ZXIncyBzdGF0ZW1lbnRzXG4gKiAoV2ViIEZ1bmN0aW9ucyBoYXZlIG5vIEFkZFBlcm1pc3Npb246IHRoZSBwb2xpY3kgaXMgYSBzaW5nbGUgZG9jdW1lbnQsIHNvIHdyaXRlcnMgbWVyZ2UgaW50byBpdCkuXG4gKi9cbmV4cG9ydCBjb25zdCBSRVNPVVJDRV9QT0xJQ1lfU1RBVEVNRU5UU19SRVNPVVJDRV9UWVBFID0gJ0N1c3RvbTo6TGFtYmRhV2ViUmVzb3VyY2VQb2xpY3lTdGF0ZW1lbnRzJztcblxuZXhwb3J0IGludGVyZmFjZSBSZXNvdXJjZVBvbGljeVN0YXRlbWVudHNQcm9wZXJ0aWVzIHtcbiAgcmVhZG9ubHkgRnVuY3Rpb25Bcm46IHN0cmluZztcbiAgLyoqIFRoZSBzdGF0ZW1lbnRzIHRoaXMgcmVzb3VyY2Ugb3ducywgZWFjaCB3aXRoIGEgU2lkIHVuaXF1ZSBpbiB0aGUgZnVuY3Rpb24ncyBwb2xpY3kuICovXG4gIHJlYWRvbmx5IFBvbGljeTogeyByZWFkb25seSBTdGF0ZW1lbnQ6IFJlYWRvbmx5QXJyYXk8eyByZWFkb25seSBTaWQ6IHN0cmluZzsgcmVhZG9ubHkgW2tleTogc3RyaW5nXTogdW5rbm93biB9PiB9O1xufVxuIl19

package/lib/private/resource-policy-statements.d.ts

@@ -0,0 +1,23 @@
+import { CustomResource } from 'aws-cdk-lib';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import { Construct } from 'constructs';
+/**
+ * The statements one stack adds to a Web Function's resource policy. A function has a single policy and Web Functions
+ * have no AddPermission, so each writing stack owns its statements (by Sid) and a custom resource merges them into the
+ * policy, keeping every other stack's statements: the function's stack, a distribution's stack, an importing stack.
+ */
+export declare class ResourcePolicyStatements extends Construct {
+    /**
+     * The writer for `functionArn` in `scope`'s stack. In the function's own stack it's a child of `host` (the function);
+     * elsewhere a child of the stack, one per function.
+     */
+    static of(scope: Construct, host: Construct, functionArn: string): ResourcePolicyStatements;
+    readonly resource: CustomResource;
+    private readonly document;
+    private readonly added;
+    private readonly sidPrefix;
+    private counter;
+    private constructor();
+    /** Adds a statement (a copy, with a Sid if it has none). An identical statement is only added once. */
+    add(statement: iam.PolicyStatement): void;
+}

package/lib/private/resource-policy-statements.js

@@ -0,0 +1,112 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourcePolicyStatements = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const iam = __importStar(require("aws-cdk-lib/aws-iam"));
+const constructs_1 = require("constructs");
+const provider_1 = require("./provider");
+const provider_protocol_1 = require("./provider-protocol");
+const resource_policy_1 = require("./resource-policy");
+/**
+ * The statements one stack adds to a Web Function's resource policy. A function has a single policy and Web Functions
+ * have no AddPermission, so each writing stack owns its statements (by Sid) and a custom resource merges them into the
+ * policy, keeping every other stack's statements: the function's stack, a distribution's stack, an importing stack.
+ */
+class ResourcePolicyStatements extends constructs_1.Construct {
+    /**
+     * The writer for `functionArn` in `scope`'s stack. In the function's own stack it's a child of `host` (the function);
+     * elsewhere a child of the stack, one per function.
+     */
+    static of(scope, host, functionArn) {
+        const stack = aws_cdk_lib_1.Stack.of(scope);
+        const [parent, id] = aws_cdk_lib_1.Stack.of(host) === stack
+            ? [host, 'ResourcePolicyStatements']
+            : [stack, `ResourcePolicyStatements${aws_cdk_lib_1.Names.uniqueId(host)}`];
+        return parent.node.tryFindChild(id)
+            ?? new ResourcePolicyStatements(parent, id, functionArn, host);
+    }
+    resource;
+    document = new iam.PolicyDocument();
+    added = new Map();
+    sidPrefix;
+    counter = 0;
+    constructor(scope, id, functionArn, warnOn) {
+        super(scope, id);
+        // Generated Sids carry a hash of this writer's path, so two stacks' statements never share one.
+        this.sidPrefix = `Cdk${aws_cdk_lib_1.Names.uniqueId(this).slice(-8)}`;
+        const provider = (0, provider_1.webFunctionProvider)(this);
+        // Stable grant (see grantToProvider): any Web Function of this account, in any region (imports may be elsewhere).
+        (0, provider_1.grantToProvider)(provider, {
+            Action: ['lambda:GetResourcePolicy', 'lambda:PutResourcePolicy', 'lambda:DeleteResourcePolicy'],
+            Resource: aws_cdk_lib_1.Stack.of(this).formatArn({
+                service: 'lambda', region: '*', resource: 'web-function', resourceName: '*', arnFormat: aws_cdk_lib_1.ArnFormat.SLASH_RESOURCE_NAME,
+            }),
+        });
+        this.resource = new aws_cdk_lib_1.CustomResource(this, 'Resource', {
+            serviceToken: provider.serviceToken,
+            resourceType: provider_protocol_1.RESOURCE_POLICY_STATEMENTS_RESOURCE_TYPE,
+            properties: { FunctionArn: functionArn, Policy: this.document },
+        });
+        this.node.addValidation({
+            validate: () => {
+                const json = aws_cdk_lib_1.Stack.of(this).resolve(this.document.toJSON());
+                const { errors, unscopedServices } = (0, resource_policy_1.inspectResourcePolicy)(json);
+                if (unscopedServices.length > 0) {
+                    aws_cdk_lib_1.Annotations.of(warnOn).addWarningV2('@cdk-lambda-web:servicePrincipalWithoutSource', `The resource policy lets ${[...new Set(unscopedServices)].join(', ')} call the function from any account. Restrict it with sourceArn or sourceAccount (addPermission), or a principal with conditions.`);
+                }
+                const sids = (json?.Statement ?? []).map((s) => s.Sid);
+                const duplicates = [...new Set(sids.filter((sid, i) => sids.indexOf(sid) !== i))];
+                return [
+                    ...this.document.validateForResourcePolicy(),
+                    ...errors.map((e) => `resource policy: ${e}`),
+                    ...duplicates.map((sid) => `resource policy: more than one statement has Sid '${sid}'`),
+                ];
+            },
+        });
+    }
+    /** Adds a statement (a copy, with a Sid if it has none). An identical statement is only added once. */
+    add(statement) {
+        // Resolved for the comparison only: principals render a new token each time (e.g. ServicePrincipal).
+        const key = JSON.stringify(aws_cdk_lib_1.Stack.of(this).resolve(statement.toStatementJson()));
+        if (this.added.has(key))
+            return;
+        const sid = statement.sid ?? `${this.sidPrefix}${this.counter++}`;
+        this.added.set(key, sid);
+        this.document.addStatements(statement.sid ? statement : statement.copy({ sid }));
+    }
+}
+exports.ResourcePolicyStatements = ResourcePolicyStatements;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVzb3VyY2UtcG9saWN5LXN0YXRlbWVudHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcHJpdmF0ZS9yZXNvdXJjZS1wb2xpY3ktc3RhdGVtZW50cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSw2Q0FBbUY7QUFDbkYseURBQTJDO0FBQzNDLDJDQUF1QztBQUN2Qyx5Q0FBa0U7QUFDbEUsMkRBQStFO0FBQy9FLHVEQUEwRDtBQUUxRDs7OztHQUlHO0FBQ0gsTUFBYSx3QkFBeUIsU0FBUSxzQkFBUztJQUNyRDs7O09BR0c7SUFDSSxNQUFNLENBQUMsRUFBRSxDQUFDLEtBQWdCLEVBQUUsSUFBZSxFQUFFLFdBQW1CO1FBQ3JFLE1BQU0sS0FBSyxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzlCLE1BQU0sQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLEdBQUcsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLEtBQUssS0FBSztZQUMzQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsMEJBQTBCLENBQUM7WUFDcEMsQ0FBQyxDQUFDLENBQUMsS0FBSyxFQUFFLDJCQUEyQixtQkFBSyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDL0QsT0FBUSxNQUFNLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQTBDO2VBQ3hFLElBQUksd0JBQXdCLENBQUMsTUFBTSxFQUFFLEVBQUUsRUFBRSxXQUFXLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDbkUsQ0FBQztJQUVlLFFBQVEsQ0FBaUI7SUFDeEIsUUFBUSxHQUFHLElBQUksR0FBRyxDQUFDLGNBQWMsRUFBRSxDQUFDO0lBQ3BDLEtBQUssR0FBRyxJQUFJLEdBQUcsRUFBa0IsQ0FBQztJQUNsQyxTQUFTLENBQVM7SUFDM0IsT0FBTyxHQUFHLENBQUMsQ0FBQztJQUVwQixZQUFvQixLQUFnQixFQUFFLEVBQVUsRUFBRSxXQUFtQixFQUFFLE1BQWlCO1FBQ3RGLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDakIsZ0dBQWdHO1FBQ2hHLElBQUksQ0FBQyxTQUFTLEdBQUcsTUFBTSxtQkFBSyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ3hELE1BQU0sUUFBUSxHQUFHLElBQUEsOEJBQW1CLEVBQUMsSUFBSSxDQUFDLENBQUM7UUFDM0Msa0hBQWtIO1FBQ2xILElBQUEsMEJBQWUsRUFBQyxRQUFRLEVBQUU7WUFDeEIsTUFBTSxFQUFFLENBQUMsMEJBQTBCLEVBQUUsMEJBQTBCLEVBQUUsNkJBQTZCLENBQUM7WUFDL0YsUUFBUSxFQUFFLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsQ0FBQztnQkFDakMsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxjQUFjLEVBQUUsWUFBWSxFQUFFLEdBQUcsRUFBRSxTQUFTLEVBQUUsdUJBQVMsQ0FBQyxtQkFBbUI7YUFDdEgsQ0FBQztTQUNILENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSw0QkFBYyxDQUFDLElBQUksRUFBRSxVQUFVLEVBQUU7WUFDbkQsWUFBWSxFQUFFLFFBQVEsQ0FBQyxZQUFZO1lBQ25DLFlBQVksRUFBRSw0REFBd0M7WUFDdEQsVUFBVSxFQUFFLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLFFBQVEsRUFBRTtTQUNoRSxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQztZQUN0QixRQUFRLEVBQUUsR0FBRyxFQUFFO2dCQUNiLE1BQU0sSUFBSSxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7Z0JBQzVELE1BQU0sRUFBRSxNQUFNLEVBQUUsZ0JBQWdCLEVBQUUsR0FBRyxJQUFBLHVDQUFxQixFQUFDLElBQUksQ0FBQyxDQUFDO2dCQUNqRSxJQUFJLGdCQUFnQixDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztvQkFDaEMseUJBQVcsQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLENBQUMsWUFBWSxDQUFDLCtDQUErQyxFQUNqRiw0QkFBNEIsQ0FBQyxHQUFHLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLG1JQUFtSSxDQUFDLENBQUM7Z0JBQzlNLENBQUM7Z0JBQ0QsTUFBTSxJQUFJLEdBQUcsQ0FBQyxJQUFJLEVBQUUsU0FBUyxJQUFJLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQWtCLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQztnQkFDeEUsTUFBTSxVQUFVLEdBQUcsQ0FBQyxHQUFHLElBQUksR0FBRyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxHQUFXLEVBQUUsQ0FBUyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztnQkFDbEcsT0FBTztvQkFDTCxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMseUJBQXlCLEVBQUU7b0JBQzVDLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsb0JBQW9CLENBQUMsRUFBRSxDQUFDO29CQUM3QyxHQUFHLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLHFEQUFxRCxHQUFHLEdBQUcsQ0FBQztpQkFDeEYsQ0FBQztZQUNKLENBQUM7U0FDRixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQsdUdBQXVHO0lBQ2hHLEdBQUcsQ0FBQyxTQUE4QjtRQUN2QyxxR0FBcUc7UUFDckcsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLGVBQWUsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUNoRixJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQztZQUFFLE9BQU87UUFDaEMsTUFBTSxHQUFHLEdBQUcsU0FBUyxDQUFDLEdBQUcsSUFBSSxHQUFHLElBQUksQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDbEUsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQ3pCLElBQUksQ0FBQyxRQUFRLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLEdBQUcsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUNuRixDQUFDO0NBQ0Y7QUFsRUQsNERBa0VDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQW5ub3RhdGlvbnMsIEFybkZvcm1hdCwgQ3VzdG9tUmVzb3VyY2UsIE5hbWVzLCBTdGFjayB9IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCAqIGFzIGlhbSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgZ3JhbnRUb1Byb3ZpZGVyLCB3ZWJGdW5jdGlvblByb3ZpZGVyIH0gZnJvbSAnLi9wcm92aWRlcic7XG5pbXBvcnQgeyBSRVNPVVJDRV9QT0xJQ1lfU1RBVEVNRU5UU19SRVNPVVJDRV9UWVBFIH0gZnJvbSAnLi9wcm92aWRlci1wcm90b2NvbCc7XG5pbXBvcnQgeyBpbnNwZWN0UmVzb3VyY2VQb2xpY3kgfSBmcm9tICcuL3Jlc291cmNlLXBvbGljeSc7XG5cbi8qKlxuICogVGhlIHN0YXRlbWVudHMgb25lIHN0YWNrIGFkZHMgdG8gYSBXZWIgRnVuY3Rpb24ncyByZXNvdXJjZSBwb2xpY3kuIEEgZnVuY3Rpb24gaGFzIGEgc2luZ2xlIHBvbGljeSBhbmQgV2ViIEZ1bmN0aW9uc1xuICogaGF2ZSBubyBBZGRQZXJtaXNzaW9uLCBzbyBlYWNoIHdyaXRpbmcgc3RhY2sgb3ducyBpdHMgc3RhdGVtZW50cyAoYnkgU2lkKSBhbmQgYSBjdXN0b20gcmVzb3VyY2UgbWVyZ2VzIHRoZW0gaW50byB0aGVcbiAqIHBvbGljeSwga2VlcGluZyBldmVyeSBvdGhlciBzdGFjaydzIHN0YXRlbWVudHM6IHRoZSBmdW5jdGlvbidzIHN0YWNrLCBhIGRpc3RyaWJ1dGlvbidzIHN0YWNrLCBhbiBpbXBvcnRpbmcgc3RhY2suXG4gKi9cbmV4cG9ydCBjbGFzcyBSZXNvdXJjZVBvbGljeVN0YXRlbWVudHMgZXh0ZW5kcyBDb25zdHJ1Y3Qge1xuICAvKipcbiAgICogVGhlIHdyaXRlciBmb3IgYGZ1bmN0aW9uQXJuYCBpbiBgc2NvcGVgJ3Mgc3RhY2suIEluIHRoZSBmdW5jdGlvbidzIG93biBzdGFjayBpdCdzIGEgY2hpbGQgb2YgYGhvc3RgICh0aGUgZnVuY3Rpb24pO1xuICAgKiBlbHNld2hlcmUgYSBjaGlsZCBvZiB0aGUgc3RhY2ssIG9uZSBwZXIgZnVuY3Rpb24uXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIG9mKHNjb3BlOiBDb25zdHJ1Y3QsIGhvc3Q6IENvbnN0cnVjdCwgZnVuY3Rpb25Bcm46IHN0cmluZyk6IFJlc291cmNlUG9saWN5U3RhdGVtZW50cyB7XG4gICAgY29uc3Qgc3RhY2sgPSBTdGFjay5vZihzY29wZSk7XG4gICAgY29uc3QgW3BhcmVudCwgaWRdID0gU3RhY2sub2YoaG9zdCkgPT09IHN0YWNrXG4gICAgICA/IFtob3N0LCAnUmVzb3VyY2VQb2xpY3lTdGF0ZW1lbnRzJ11cbiAgICAgIDogW3N0YWNrLCBgUmVzb3VyY2VQb2xpY3lTdGF0ZW1lbnRzJHtOYW1lcy51bmlxdWVJZChob3N0KX1gXTtcbiAgICByZXR1cm4gKHBhcmVudC5ub2RlLnRyeUZpbmRDaGlsZChpZCkgYXMgUmVzb3VyY2VQb2xpY3lTdGF0ZW1lbnRzIHwgdW5kZWZpbmVkKVxuICAgICAgPz8gbmV3IFJlc291cmNlUG9saWN5U3RhdGVtZW50cyhwYXJlbnQsIGlkLCBmdW5jdGlvbkFybiwgaG9zdCk7XG4gIH1cblxuICBwdWJsaWMgcmVhZG9ubHkgcmVzb3VyY2U6IEN1c3RvbVJlc291cmNlO1xuICBwcml2YXRlIHJlYWRvbmx5IGRvY3VtZW50ID0gbmV3IGlhbS5Qb2xpY3lEb2N1bWVudCgpO1xuICBwcml2YXRlIHJlYWRvbmx5IGFkZGVkID0gbmV3IE1hcDxzdHJpbmcsIHN0cmluZz4oKTtcbiAgcHJpdmF0ZSByZWFkb25seSBzaWRQcmVmaXg6IHN0cmluZztcbiAgcHJpdmF0ZSBjb3VudGVyID0gMDtcblxuICBwcml2YXRlIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIGZ1bmN0aW9uQXJuOiBzdHJpbmcsIHdhcm5PbjogQ29uc3RydWN0KSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkKTtcbiAgICAvLyBHZW5lcmF0ZWQgU2lkcyBjYXJyeSBhIGhhc2ggb2YgdGhpcyB3cml0ZXIncyBwYXRoLCBzbyB0d28gc3RhY2tzJyBzdGF0ZW1lbnRzIG5ldmVyIHNoYXJlIG9uZS5cbiAgICB0aGlzLnNpZFByZWZpeCA9IGBDZGske05hbWVzLnVuaXF1ZUlkKHRoaXMpLnNsaWNlKC04KX1gO1xuICAgIGNvbnN0IHByb3ZpZGVyID0gd2ViRnVuY3Rpb25Qcm92aWRlcih0aGlzKTtcbiAgICAvLyBTdGFibGUgZ3JhbnQgKHNlZSBncmFudFRvUHJvdmlkZXIpOiBhbnkgV2ViIEZ1bmN0aW9uIG9mIHRoaXMgYWNjb3VudCwgaW4gYW55IHJlZ2lvbiAoaW1wb3J0cyBtYXkgYmUgZWxzZXdoZXJlKS5cbiAgICBncmFudFRvUHJvdmlkZXIocHJvdmlkZXIsIHtcbiAgICAgIEFjdGlvbjogWydsYW1iZGE6R2V0UmVzb3VyY2VQb2xpY3knLCAnbGFtYmRhOlB1dFJlc291cmNlUG9saWN5JywgJ2xhbWJkYTpEZWxldGVSZXNvdXJjZVBvbGljeSddLFxuICAgICAgUmVzb3VyY2U6IFN0YWNrLm9mKHRoaXMpLmZvcm1hdEFybih7XG4gICAgICAgIHNlcnZpY2U6ICdsYW1iZGEnLCByZWdpb246ICcqJywgcmVzb3VyY2U6ICd3ZWItZnVuY3Rpb24nLCByZXNvdXJjZU5hbWU6ICcqJywgYXJuRm9ybWF0OiBBcm5Gb3JtYXQuU0xBU0hfUkVTT1VSQ0VfTkFNRSxcbiAgICAgIH0pLFxuICAgIH0pO1xuICAgIHRoaXMucmVzb3VyY2UgPSBuZXcgQ3VzdG9tUmVzb3VyY2UodGhpcywgJ1Jlc291cmNlJywge1xuICAgICAgc2VydmljZVRva2VuOiBwcm92aWRlci5zZXJ2aWNlVG9rZW4sXG4gICAgICByZXNvdXJjZVR5cGU6IFJFU09VUkNFX1BPTElDWV9TVEFURU1FTlRTX1JFU09VUkNFX1RZUEUsXG4gICAgICBwcm9wZXJ0aWVzOiB7IEZ1bmN0aW9uQXJuOiBmdW5jdGlvbkFybiwgUG9saWN5OiB0aGlzLmRvY3VtZW50IH0sXG4gICAgfSk7XG5cbiAgICB0aGlzLm5vZGUuYWRkVmFsaWRhdGlvbih7XG4gICAgICB2YWxpZGF0ZTogKCkgPT4ge1xuICAgICAgICBjb25zdCBqc29uID0gU3RhY2sub2YodGhpcykucmVzb2x2ZSh0aGlzLmRvY3VtZW50LnRvSlNPTigpKTtcbiAgICAgICAgY29uc3QgeyBlcnJvcnMsIHVuc2NvcGVkU2VydmljZXMgfSA9IGluc3BlY3RSZXNvdXJjZVBvbGljeShqc29uKTtcbiAgICAgICAgaWYgKHVuc2NvcGVkU2VydmljZXMubGVuZ3RoID4gMCkge1xuICAgICAgICAgIEFubm90YXRpb25zLm9mKHdhcm5PbikuYWRkV2FybmluZ1YyKCdAY2RrLWxhbWJkYS13ZWI6c2VydmljZVByaW5jaXBhbFdpdGhvdXRTb3VyY2UnLFxuICAgICAgICAgICAgYFRoZSByZXNvdXJjZSBwb2xpY3kgbGV0cyAke1suLi5uZXcgU2V0KHVuc2NvcGVkU2VydmljZXMpXS5qb2luKCcsICcpfSBjYWxsIHRoZSBmdW5jdGlvbiBmcm9tIGFueSBhY2NvdW50LiBSZXN0cmljdCBpdCB3aXRoIHNvdXJjZUFybiBvciBzb3VyY2VBY2NvdW50IChhZGRQZXJtaXNzaW9uKSwgb3IgYSBwcmluY2lwYWwgd2l0aCBjb25kaXRpb25zLmApO1xuICAgICAgICB9XG4gICAgICAgIGNvbnN0IHNpZHMgPSAoanNvbj8uU3RhdGVtZW50ID8/IFtdKS5tYXAoKHM6IHsgU2lkOiBzdHJpbmcgfSkgPT4gcy5TaWQpO1xuICAgICAgICBjb25zdCBkdXBsaWNhdGVzID0gWy4uLm5ldyBTZXQoc2lkcy5maWx0ZXIoKHNpZDogc3RyaW5nLCBpOiBudW1iZXIpID0+IHNpZHMuaW5kZXhPZihzaWQpICE9PSBpKSldO1xuICAgICAgICByZXR1cm4gW1xuICAgICAgICAgIC4uLnRoaXMuZG9jdW1lbnQudmFsaWRhdGVGb3JSZXNvdXJjZVBvbGljeSgpLFxuICAgICAgICAgIC4uLmVycm9ycy5tYXAoKGUpID0+IGByZXNvdXJjZSBwb2xpY3k6ICR7ZX1gKSxcbiAgICAgICAgICAuLi5kdXBsaWNhdGVzLm1hcCgoc2lkKSA9PiBgcmVzb3VyY2UgcG9saWN5OiBtb3JlIHRoYW4gb25lIHN0YXRlbWVudCBoYXMgU2lkICcke3NpZH0nYCksXG4gICAgICAgIF07XG4gICAgICB9LFxuICAgIH0pO1xuICB9XG5cbiAgLyoqIEFkZHMgYSBzdGF0ZW1lbnQgKGEgY29weSwgd2l0aCBhIFNpZCBpZiBpdCBoYXMgbm9uZSkuIEFuIGlkZW50aWNhbCBzdGF0ZW1lbnQgaXMgb25seSBhZGRlZCBvbmNlLiAqL1xuICBwdWJsaWMgYWRkKHN0YXRlbWVudDogaWFtLlBvbGljeVN0YXRlbWVudCk6IHZvaWQge1xuICAgIC8vIFJlc29sdmVkIGZvciB0aGUgY29tcGFyaXNvbiBvbmx5OiBwcmluY2lwYWxzIHJlbmRlciBhIG5ldyB0b2tlbiBlYWNoIHRpbWUgKGUuZy4gU2VydmljZVByaW5jaXBhbCkuXG4gICAgY29uc3Qga2V5ID0gSlNPTi5zdHJpbmdpZnkoU3RhY2sub2YodGhpcykucmVzb2x2ZShzdGF0ZW1lbnQudG9TdGF0ZW1lbnRKc29uKCkpKTtcbiAgICBpZiAodGhpcy5hZGRlZC5oYXMoa2V5KSkgcmV0dXJuO1xuICAgIGNvbnN0IHNpZCA9IHN0YXRlbWVudC5zaWQgPz8gYCR7dGhpcy5zaWRQcmVmaXh9JHt0aGlzLmNvdW50ZXIrK31gO1xuICAgIHRoaXMuYWRkZWQuc2V0KGtleSwgc2lkKTtcbiAgICB0aGlzLmRvY3VtZW50LmFkZFN0YXRlbWVudHMoc3RhdGVtZW50LnNpZCA/IHN0YXRlbWVudCA6IHN0YXRlbWVudC5jb3B5KHsgc2lkIH0pKTtcbiAgfVxufVxuIl19

package/lib/private/traffic-shift.js

@@ -42,6 +42,7 @@ const lambda = __importStar(require("aws-cdk-lib/aws-lambda"));
 const logs = __importStar(require("aws-cdk-lib/aws-logs"));
 const cr = __importStar(require("aws-cdk-lib/custom-resources"));
 const constructs_1 = require("constructs");
+const nag_1 = require("./nag");
 const provider_protocol_1 = require("./provider-protocol");
 /** The Provider framework gives up after this long and fails the deployment (with a message), before CloudFormation's own 1-hour limit. */
 const TOTAL_TIMEOUT = aws_cdk_lib_1.Duration.minutes(55);
@@ -61,15 +62,14 @@ class DeploymentProvider extends constructs_1.Construct {
     granted = new Set();
     constructor(scope, id) {
         super(scope, id);
-        this.role = new iam.Role(this, 'Role', {
-            assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
-            managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole')],
-        });
+        const logGroup = new logs.LogGroup(this, 'Logs', { retention: logs.RetentionDays.ONE_MONTH, removalPolicy: aws_cdk_lib_1.RemovalPolicy.DESTROY });
+        this.role = new iam.Role(this, 'Role', { assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com') });
+        // Its own log group only (not AWSLambdaBasicExecutionRole, which can create any group).
+        this.grant({ actions: ['logs:CreateLogStream', 'logs:PutLogEvents'], resources: [logGroup.logGroupArn] });
         // Rollback detection: is the stack rolling back? (the provider's own stack only).
         this.grant({ actions: ['cloudformation:DescribeStacks'], resources: [aws_cdk_lib_1.Stack.of(this).stackId] });
         // Composite alarms are only returned with DescribeAlarms on '*'.
         this.grant({ actions: ['cloudwatch:DescribeAlarms'], resources: ['*'] });
-        const logGroup = new logs.LogGroup(this, 'Logs', { retention: logs.RetentionDays.ONE_MONTH, removalPolicy: aws_cdk_lib_1.RemovalPolicy.DESTROY });
         const handler = (name, handlerName, description) => new lambda.Function(this, name, {
             runtime: lambda.Runtime.NODEJS_24_X,
             architecture: lambda.Architecture.ARM_64,
@@ -90,6 +90,10 @@ class DeploymentProvider extends constructs_1.Construct {
             logGroup,
         });
         this.serviceToken = provider.serviceToken;
+        (0, nag_1.acknowledgeIamFindings)(this.role.node.findChild('DefaultPolicy').node.defaultChild, 'The deployment handlers\' own log group, DescribeAlarms (composite alarms need *), and the revisions and endpoints of the functions they deploy');
+        (0, nag_1.acknowledgeNagUnder)(provider, 'The CDK custom resource Provider framework\'s own functions and waiter state machine', {
+            'AWS::StepFunctions::StateMachine': ['AwsSolutions-SF1', 'AwsSolutions-SF2'],
+        });
     }
     /**
      * Adds a statement to the handlers' role, once. Like the shared provider's grants, they must be stable across
@@ -141,4 +145,4 @@ class TrafficShift extends constructs_1.Construct {
     }
 }
 exports.TrafficShift = TrafficShift;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHJhZmZpYy1zaGlmdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9wcml2YXRlL3RyYWZmaWMtc2hpZnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsNkNBQXlDO0FBQ3pDLGdEQUFrQztBQUNsQyw2Q0FBd0Y7QUFDeEYseURBQTJDO0FBQzNDLCtEQUFpRDtBQUNqRCwyREFBNkM7QUFDN0MsaUVBQW1EO0FBQ25ELDJDQUF1QztBQUN2QywyREFBK0Y7QUFHL0YsMklBQTJJO0FBQzNJLE1BQU0sYUFBYSxHQUFHLHNCQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBQzNDLE1BQU0sV0FBVyxHQUFHLDZCQUE2QixDQUFDO0FBRWxEOzs7O0dBSUc7QUFDSCxNQUFNLGtCQUFtQixTQUFRLHNCQUFTO0lBQ2pDLE1BQU0sQ0FBQyxFQUFFLENBQUMsS0FBZ0I7UUFDL0IsTUFBTSxLQUFLLEdBQUcsbUJBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDOUIsT0FBUSxLQUFLLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQW9DLElBQUksSUFBSSxrQkFBa0IsQ0FBQyxLQUFLLEVBQUUsV0FBVyxDQUFDLENBQUM7SUFDaEksQ0FBQztJQUVlLFlBQVksQ0FBUztJQUNwQixJQUFJLENBQVc7SUFDZixPQUFPLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUU3QyxZQUFvQixLQUFnQixFQUFFLEVBQVU7UUFDOUMsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztRQUNqQixJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFO1lBQ3JDLFNBQVMsRUFBRSxJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxzQkFBc0IsQ0FBQztZQUMzRCxlQUFlLEVBQUUsQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLHdCQUF3QixDQUFDLDBDQUEwQyxDQUFDLENBQUM7U0FDMUcsQ0FBQyxDQUFDO1FBQ0gsa0ZBQWtGO1FBQ2xGLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxPQUFPLEVBQUUsQ0FBQywrQkFBK0IsQ0FBQyxFQUFFLFNBQVMsRUFBRSxDQUFDLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNoRyxpRUFBaUU7UUFDakUsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLE9BQU8sRUFBRSxDQUFDLDJCQUEyQixDQUFDLEVBQUUsU0FBUyxFQUFFLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBRXpFLE1BQU0sUUFBUSxHQUFHLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksQ0FBQyxhQUFhLENBQUMsU0FBUyxFQUFFLGFBQWEsRUFBRSwyQkFBYSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUM7UUFDcEksTUFBTSxPQUFPLEdBQUcsQ0FBQyxJQUFZLEVBQUUsV0FBbUIsRUFBRSxXQUFtQixFQUFFLEVBQUUsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxFQUFFLElBQUksRUFBRTtZQUMxRyxPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxXQUFXO1lBQ25DLFlBQVksRUFBRSxNQUFNLENBQUMsWUFBWSxDQUFDLE1BQU07WUFDeEMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLHlCQUF5QixDQUFDLENBQUM7WUFDbEcsT0FBTyxFQUFFLFNBQVMsV0FBVyxFQUFFO1lBQy9CLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSTtZQUNmLHNHQUFzRztZQUN0RyxPQUFPLEVBQUUsc0JBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO1lBQzVCLFVBQVUsRUFBRSxHQUFHO1lBQ2YsUUFBUTtZQUNSLFdBQVc7U0FDWixDQUFDLENBQUM7UUFDSCxNQUFNLFFBQVEsR0FBRyxJQUFJLEVBQUUsQ0FBQyxRQUFRLENBQUMsSUFBSSxFQUFFLFVBQVUsRUFBRTtZQUNqRCxjQUFjLEVBQUUsT0FBTyxDQUFDLFNBQVMsRUFBRSxTQUFTLEVBQUUsdUVBQXVFLENBQUM7WUFDdEgsaUJBQWlCLEVBQUUsT0FBTyxDQUFDLFlBQVksRUFBRSxZQUFZLEVBQUUsNEVBQTRFLENBQUM7WUFDcEksYUFBYSxFQUFFLHNCQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNuQyxZQUFZLEVBQUUsYUFBYTtZQUMzQixRQUFRO1NBQ1QsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLFlBQVksR0FBRyxRQUFRLENBQUMsWUFBWSxDQUFDO0lBQzVDLENBQUM7SUFFRDs7O09BR0c7SUFDSSxLQUFLLENBQUMsU0FBcUQ7UUFDaEUsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztRQUM5RCxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQztZQUFFLE9BQU87UUFDbEMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDdEIsSUFBSSxDQUFDLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztJQUNyRSxDQUFDO0NBQ0Y7QUFlRDs7R0FFRztBQUNILE1BQWEsWUFBYSxTQUFRLHNCQUFTO0lBQ3pCLFFBQVEsQ0FBaUI7SUFFekMsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUF3QjtRQUNoRSxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ2pCLE1BQU0sS0FBSyxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzdCLE1BQU0sUUFBUSxHQUFHLGtCQUFrQixDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM3QyxNQUFNLFdBQVcsR0FBRyxLQUFLLENBQUMsU0FBUyxDQUFDO1lBQ2xDLE9BQU8sRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLGNBQWMsRUFBRSxZQUFZLEVBQUUsS0FBSyxDQUFDLFlBQVksRUFBRSxTQUFTLEVBQUUsdUJBQVMsQ0FBQyxtQkFBbUI7U0FDeEgsQ0FBQyxDQUFDO1FBQ0gsbUZBQW1GO1FBQ25GLFFBQVEsQ0FBQyxLQUFLLENBQUM7WUFDYixPQUFPLEVBQUUsQ0FBQywrQkFBK0IsRUFBRSxrQ0FBa0MsQ0FBQztZQUM5RSxTQUFTLEVBQUUsQ0FBQyxXQUFXLEVBQUUsR0FBRyxXQUFXLGFBQWEsRUFBRSxHQUFHLFdBQVcsYUFBYSxDQUFDO1NBQ25GLENBQUMsQ0FBQztRQUVILE1BQU0sVUFBVSxHQUFHLEtBQUssQ0FBQyxVQUFVLENBQUM7UUFDcEMsTUFBTSxTQUFTLEdBQUcsQ0FBQyxHQUFHLFVBQVUsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLEVBQUUsR0FBRyxDQUFDLEtBQUssQ0FBQyxTQUFTLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztRQUM3RixNQUFNLFVBQVUsR0FBMkI7WUFDekMsV0FBVyxFQUFFLEtBQUssQ0FBQyxXQUFXO1lBQzlCLFlBQVksRUFBRSxLQUFLLENBQUMsWUFBWTtZQUNoQyxVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVU7WUFDNUIsS0FBSyxFQUFFLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQztZQUNsQyxXQUFXLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUM7WUFDNUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVM7WUFDdkQsY0FBYyxFQUFFLElBQUEsd0JBQVUsRUFBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDO1NBQzVILENBQUM7UUFDRixJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksNEJBQWMsQ0FBQyxJQUFJLEVBQUUsVUFBVSxFQUFFO1lBQ25ELFlBQVksRUFBRSxRQUFRLENBQUMsWUFBWTtZQUNuQyxZQUFZLEVBQUUsK0NBQTJCO1lBQ3pDLFVBQVUsRUFBRSxFQUFFLEdBQUcsVUFBVSxFQUFFO1lBQzdCLHVGQUF1RjtZQUN2RixjQUFjLEVBQUUsc0JBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1NBQ2xDLENBQUMsQ0FBQztJQUNMLENBQUM7Q0FDRjtBQW5DRCxvQ0FtQ0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBjcmVhdGVIYXNoIH0gZnJvbSAnbm9kZTpjcnlwdG8nO1xuaW1wb3J0ICogYXMgcGF0aCBmcm9tICdub2RlOnBhdGgnO1xuaW1wb3J0IHsgQXJuRm9ybWF0LCBDdXN0b21SZXNvdXJjZSwgRHVyYXRpb24sIFJlbW92YWxQb2xpY3ksIFN0YWNrIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0ICogYXMgaWFtIGZyb20gJ2F3cy1jZGstbGliL2F3cy1pYW0nO1xuaW1wb3J0ICogYXMgbGFtYmRhIGZyb20gJ2F3cy1jZGstbGliL2F3cy1sYW1iZGEnO1xuaW1wb3J0ICogYXMgbG9ncyBmcm9tICdhd3MtY2RrLWxpYi9hd3MtbG9ncyc7XG5pbXBvcnQgKiBhcyBjciBmcm9tICdhd3MtY2RrLWxpYi9jdXN0b20tcmVzb3VyY2VzJztcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgVFJBRkZJQ19TSElGVF9SRVNPVVJDRV9UWVBFLCB0eXBlIFRyYWZmaWNTaGlmdFByb3BlcnRpZXMgfSBmcm9tICcuL3Byb3ZpZGVyLXByb3RvY29sJztcbmltcG9ydCB0eXBlIHsgV2ViRnVuY3Rpb25EZXBsb3ltZW50IH0gZnJvbSAnLi4vd2ViLWZ1bmN0aW9uLWRlcGxveW1lbnQnO1xuXG4vKiogVGhlIFByb3ZpZGVyIGZyYW1ld29yayBnaXZlcyB1cCBhZnRlciB0aGlzIGxvbmcgYW5kIGZhaWxzIHRoZSBkZXBsb3ltZW50ICh3aXRoIGEgbWVzc2FnZSksIGJlZm9yZSBDbG91ZEZvcm1hdGlvbidzIG93biAxLWhvdXIgbGltaXQuICovXG5jb25zdCBUT1RBTF9USU1FT1VUID0gRHVyYXRpb24ubWludXRlcyg1NSk7XG5jb25zdCBQUk9WSURFUl9JRCA9ICdMYW1iZGFXZWJEZXBsb3ltZW50UHJvdmlkZXInO1xuXG4vKipcbiAqIFRoZSBzdGFjaydzIGRlcGxveW1lbnQgcHJvdmlkZXI6IGEgQ0RLIFByb3ZpZGVyIGZyYW1ld29yayAoYSBTdGVwIEZ1bmN0aW9ucyB3YWl0ZXIpIGFyb3VuZCBgb25FdmVudGAgYW5kIGBpc0NvbXBsZXRlYFxuICogZnJvbSBgaGFuZGxlcnMvd2ViLWZ1bmN0aW9uLWRlcGxveW1lbnRgLCBiZWNhdXNlIGEgY2FuYXJ5IG9yIGxpbmVhciBkZXBsb3ltZW50IGNhbiBydW4gZm9yIHVwIHRvIGFuIGhvdXIuXG4gKiBPbmUgcGVyIHN0YWNrLCBzaGFyZWQgYnkgZXZlcnkgZW5kcG9pbnQgdGhhdCBkZXBsb3lzIGluIHN0ZXBzLlxuICovXG5jbGFzcyBEZXBsb3ltZW50UHJvdmlkZXIgZXh0ZW5kcyBDb25zdHJ1Y3Qge1xuICBwdWJsaWMgc3RhdGljIG9mKHNjb3BlOiBDb25zdHJ1Y3QpOiBEZXBsb3ltZW50UHJvdmlkZXIge1xuICAgIGNvbnN0IHN0YWNrID0gU3RhY2sub2Yoc2NvcGUpO1xuICAgIHJldHVybiAoc3RhY2subm9kZS50cnlGaW5kQ2hpbGQoUFJPVklERVJfSUQpIGFzIERlcGxveW1lbnRQcm92aWRlciB8IHVuZGVmaW5lZCkgPz8gbmV3IERlcGxveW1lbnRQcm92aWRlcihzdGFjaywgUFJPVklERVJfSUQpO1xuICB9XG5cbiAgcHVibGljIHJlYWRvbmx5IHNlcnZpY2VUb2tlbjogc3RyaW5nO1xuICBwcml2YXRlIHJlYWRvbmx5IHJvbGU6IGlhbS5Sb2xlO1xuICBwcml2YXRlIHJlYWRvbmx5IGdyYW50ZWQgPSBuZXcgU2V0PHN0cmluZz4oKTtcblxuICBwcml2YXRlIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcpIHtcbiAgICBzdXBlcihzY29wZSwgaWQpO1xuICAgIHRoaXMucm9sZSA9IG5ldyBpYW0uUm9sZSh0aGlzLCAnUm9sZScsIHtcbiAgICAgIGFzc3VtZWRCeTogbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKCdsYW1iZGEuYW1hem9uYXdzLmNvbScpLFxuICAgICAgbWFuYWdlZFBvbGljaWVzOiBbaWFtLk1hbmFnZWRQb2xpY3kuZnJvbUF3c01hbmFnZWRQb2xpY3lOYW1lKCdzZXJ2aWNlLXJvbGUvQVdTTGFtYmRhQmFzaWNFeGVjdXRpb25Sb2xlJyldLFxuICAgIH0pO1xuICAgIC8vIFJvbGxiYWNrIGRldGVjdGlvbjogaXMgdGhlIHN0YWNrIHJvbGxpbmcgYmFjaz8gKHRoZSBwcm92aWRlcidzIG93biBzdGFjayBvbmx5KS5cbiAgICB0aGlzLmdyYW50KHsgYWN0aW9uczogWydjbG91ZGZvcm1hdGlvbjpEZXNjcmliZVN0YWNrcyddLCByZXNvdXJjZXM6IFtTdGFjay5vZih0aGlzKS5zdGFja0lkXSB9KTtcbiAgICAvLyBDb21wb3NpdGUgYWxhcm1zIGFyZSBvbmx5IHJldHVybmVkIHdpdGggRGVzY3JpYmVBbGFybXMgb24gJyonLlxuICAgIHRoaXMuZ3JhbnQoeyBhY3Rpb25zOiBbJ2Nsb3Vkd2F0Y2g6RGVzY3JpYmVBbGFybXMnXSwgcmVzb3VyY2VzOiBbJyonXSB9KTtcblxuICAgIGNvbnN0IGxvZ0dyb3VwID0gbmV3IGxvZ3MuTG9nR3JvdXAodGhpcywgJ0xvZ3MnLCB7IHJldGVudGlvbjogbG9ncy5SZXRlbnRpb25EYXlzLk9ORV9NT05USCwgcmVtb3ZhbFBvbGljeTogUmVtb3ZhbFBvbGljeS5ERVNUUk9ZIH0pO1xuICAgIGNvbnN0IGhhbmRsZXIgPSAobmFtZTogc3RyaW5nLCBoYW5kbGVyTmFtZTogc3RyaW5nLCBkZXNjcmlwdGlvbjogc3RyaW5nKSA9PiBuZXcgbGFtYmRhLkZ1bmN0aW9uKHRoaXMsIG5hbWUsIHtcbiAgICAgIHJ1bnRpbWU6IGxhbWJkYS5SdW50aW1lLk5PREVKU18yNF9YLFxuICAgICAgYXJjaGl0ZWN0dXJlOiBsYW1iZGEuQXJjaGl0ZWN0dXJlLkFSTV82NCxcbiAgICAgIGNvZGU6IGxhbWJkYS5Db2RlLmZyb21Bc3NldChwYXRoLmpvaW4oX19kaXJuYW1lLCAnLi4nLCAnLi4nLCAnYXNzZXRzJywgJ3dlYi1mdW5jdGlvbi1kZXBsb3ltZW50JykpLFxuICAgICAgaGFuZGxlcjogYGluZGV4LiR7aGFuZGxlck5hbWV9YCxcbiAgICAgIHJvbGU6IHRoaXMucm9sZSxcbiAgICAgIC8vIGlzQ29tcGxldGUgd2FpdHMgdXAgdG8gNSBtaW51dGVzIGZvciBhIHJlc3RvcmUgdG8gcmVhY2ggZXZlcnkgcmVnaW9uIGJlZm9yZSBmYWlsaW5nIHRoZSBkZXBsb3ltZW50LlxuICAgICAgdGltZW91dDogRHVyYXRpb24ubWludXRlcyg3KSxcbiAgICAgIG1lbW9yeVNpemU6IDI1NixcbiAgICAgIGxvZ0dyb3VwLFxuICAgICAgZGVzY3JpcHRpb24sXG4gICAgfSk7XG4gICAgY29uc3QgcHJvdmlkZXIgPSBuZXcgY3IuUHJvdmlkZXIodGhpcywgJ1Byb3ZpZGVyJywge1xuICAgICAgb25FdmVudEhhbmRsZXI6IGhhbmRsZXIoJ09uRXZlbnQnLCAnb25FdmVudCcsICdTdGFydHMgY2FuYXJ5IGFuZCBsaW5lYXIgZGVwbG95bWVudHMgb2YgTGFtYmRhIFdlYiBGdW5jdGlvbiBlbmRwb2ludHMnKSxcbiAgICAgIGlzQ29tcGxldGVIYW5kbGVyOiBoYW5kbGVyKCdJc0NvbXBsZXRlJywgJ2lzQ29tcGxldGUnLCAnTW92ZXMgTGFtYmRhIFdlYiBGdW5jdGlvbiBlbmRwb2ludCB0cmFmZmljIHN0ZXAgYnkgc3RlcCBhbmQgd2F0Y2hlcyBhbGFybXMnKSxcbiAgICAgIHF1ZXJ5SW50ZXJ2YWw6IER1cmF0aW9uLnNlY29uZHMoMTUpLFxuICAgICAgdG90YWxUaW1lb3V0OiBUT1RBTF9USU1FT1VULFxuICAgICAgbG9nR3JvdXAsXG4gICAgfSk7XG4gICAgdGhpcy5zZXJ2aWNlVG9rZW4gPSBwcm92aWRlci5zZXJ2aWNlVG9rZW47XG4gIH1cblxuICAvKipcbiAgICogQWRkcyBhIHN0YXRlbWVudCB0byB0aGUgaGFuZGxlcnMnIHJvbGUsIG9uY2UuIExpa2UgdGhlIHNoYXJlZCBwcm92aWRlcidzIGdyYW50cywgdGhleSBtdXN0IGJlIHN0YWJsZSBhY3Jvc3NcbiAgICogdXBkYXRlcyAocHJlZml4ZXMsIG5vdCBuYW1lcyB0aGF0IGNoYW5nZSkgYW5kIG5ldmVyIHJlZmVyZW5jZSBhdHRyaWJ1dGVzIG9mIHJlc291cmNlcyB0aGF0IHVzZSB0aGUgcHJvdmlkZXIuXG4gICAqL1xuICBwdWJsaWMgZ3JhbnQoc3RhdGVtZW50OiB7IGFjdGlvbnM6IHN0cmluZ1tdOyByZXNvdXJjZXM6IHN0cmluZ1tdIH0pOiB2b2lkIHtcbiAgICBjb25zdCBrZXkgPSBKU09OLnN0cmluZ2lmeShTdGFjay5vZih0aGlzKS5yZXNvbHZlKHN0YXRlbWVudCkpO1xuICAgIGlmICh0aGlzLmdyYW50ZWQuaGFzKGtleSkpIHJldHVybjtcbiAgICB0aGlzLmdyYW50ZWQuYWRkKGtleSk7XG4gICAgdGhpcy5yb2xlLmFkZFRvUHJpbmNpcGFsUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHN0YXRlbWVudCkpO1xuICB9XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgVHJhZmZpY1NoaWZ0UHJvcHMge1xuICAvKiogTGl0ZXJhbCBmdW5jdGlvbiBuYW1lLCBmb3Igc3RhYmxlIElBTSBncmFudHMuICovXG4gIHJlYWRvbmx5IGZ1bmN0aW9uTmFtZTogc3RyaW5nO1xuICByZWFkb25seSBmdW5jdGlvbkFybjogc3RyaW5nO1xuICByZWFkb25seSBlbmRwb2ludE5hbWU6IHN0cmluZztcbiAgcmVhZG9ubHkgcmV2aXNpb25JZDogc3RyaW5nO1xuICByZWFkb25seSBkZXBsb3ltZW50OiBXZWJGdW5jdGlvbkRlcGxveW1lbnQ7XG4gIC8qKiBBUk5zIG9mIGFsYXJtcyB0aGUgZW5kcG9pbnQgY3JlYXRlZCAoYHJvbGxiYWNrT25gKSwgd2F0Y2hlZCB3aXRoIHRoZSBkZXBsb3ltZW50J3Mgb3duIGBhbGFybXNgLiAqL1xuICByZWFkb25seSBhbGFybUFybnM/OiBzdHJpbmdbXTtcbiAgLyoqIFRoZSBlbmRwb2ludCdzIG90aGVyIHNldHRpbmdzOiBhbnkgY2hhbmdlIG1ha2VzIHRoZSBzaGlmdCBydW4sIHNvIGl0IGNhbiByZS1jaGVjayB0aGUgdHJhZmZpYyBiZWZvcmUgQ2xvdWRGb3JtYXRpb24gd3JpdGVzIGl0LiAqL1xuICByZWFkb25seSBlbmRwb2ludENvbmZpZzogdW5rbm93bjtcbn1cblxuLyoqXG4gKiBNb3ZlcyBhbiBlbmRwb2ludCdzIHRyYWZmaWMgdG8gYHJldmlzaW9uSWRgIGluIHN0ZXBzIGJlZm9yZSBDbG91ZEZvcm1hdGlvbiB1cGRhdGVzIHRoZSBlbmRwb2ludCAod2hpY2ggbXVzdCBkZXBlbmQgb24gaXQpLlxuICovXG5leHBvcnQgY2xhc3MgVHJhZmZpY1NoaWZ0IGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgcHVibGljIHJlYWRvbmx5IHJlc291cmNlOiBDdXN0b21SZXNvdXJjZTtcblxuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogVHJhZmZpY1NoaWZ0UHJvcHMpIHtcbiAgICBzdXBlcihzY29wZSwgaWQpO1xuICAgIGNvbnN0IHN0YWNrID0gU3RhY2sub2YodGhpcyk7XG4gICAgY29uc3QgcHJvdmlkZXIgPSBEZXBsb3ltZW50UHJvdmlkZXIub2YodGhpcyk7XG4gICAgY29uc3QgZnVuY3Rpb25Bcm4gPSBzdGFjay5mb3JtYXRBcm4oe1xuICAgICAgc2VydmljZTogJ2xhbWJkYScsIHJlc291cmNlOiAnd2ViLWZ1bmN0aW9uJywgcmVzb3VyY2VOYW1lOiBwcm9wcy5mdW5jdGlvbk5hbWUsIGFybkZvcm1hdDogQXJuRm9ybWF0LlNMQVNIX1JFU09VUkNFX05BTUUsXG4gICAgfSk7XG4gICAgLy8gU3RhYmxlIGdyYW50IChzZWUgZ3JhbnRUb1Byb3ZpZGVyKTogZXZlcnkgZW5kcG9pbnQgYW5kIHJldmlzaW9uIG9mIHRoZSBmdW5jdGlvbi5cbiAgICBwcm92aWRlci5ncmFudCh7XG4gICAgICBhY3Rpb25zOiBbJ2xhbWJkYTpHZXRXZWJGdW5jdGlvbkVuZHBvaW50JywgJ2xhbWJkYTpVcGRhdGVXZWJGdW5jdGlvbkVuZHBvaW50J10sXG4gICAgICByZXNvdXJjZXM6IFtmdW5jdGlvbkFybiwgYCR7ZnVuY3Rpb25Bcm59L2VuZHBvaW50LypgLCBgJHtmdW5jdGlvbkFybn0vcmV2aXNpb24vKmBdLFxuICAgIH0pO1xuXG4gICAgY29uc3QgZGVwbG95bWVudCA9IHByb3BzLmRlcGxveW1lbnQ7XG4gICAgY29uc3QgYWxhcm1Bcm5zID0gWy4uLmRlcGxveW1lbnQuX2FsYXJtcy5tYXAoKGEpID0+IGEuYWxhcm1Bcm4pLCAuLi4ocHJvcHMuYWxhcm1Bcm5zID8/IFtdKV07XG4gICAgY29uc3QgcHJvcGVydGllczogVHJhZmZpY1NoaWZ0UHJvcGVydGllcyA9IHtcbiAgICAgIEZ1bmN0aW9uQXJuOiBwcm9wcy5mdW5jdGlvbkFybixcbiAgICAgIEVuZHBvaW50TmFtZTogcHJvcHMuZW5kcG9pbnROYW1lLFxuICAgICAgUmV2aXNpb25JZDogcHJvcHMucmV2aXNpb25JZCxcbiAgICAgIFN0ZXBzOiBkZXBsb3ltZW50Ll9zdGVwcy5qb2luKCcsJyksXG4gICAgICBXYWl0U2Vjb25kczogU3RyaW5nKGRlcGxveW1lbnQuX3dhaXRTZWNvbmRzKSxcbiAgICAgIEFsYXJtQXJuczogYWxhcm1Bcm5zLmxlbmd0aCA+IDAgPyBhbGFybUFybnMgOiB1bmRlZmluZWQsXG4gICAgICBFbmRwb2ludENvbmZpZzogY3JlYXRlSGFzaCgnc2hhMjU2JykudXBkYXRlKEpTT04uc3RyaW5naWZ5KHN0YWNrLnJlc29sdmUocHJvcHMuZW5kcG9pbnRDb25maWcpKSkuZGlnZXN0KCdoZXgnKS5zbGljZSgwLCAxNiksXG4gICAgfTtcbiAgICB0aGlzLnJlc291cmNlID0gbmV3IEN1c3RvbVJlc291cmNlKHRoaXMsICdSZXNvdXJjZScsIHtcbiAgICAgIHNlcnZpY2VUb2tlbjogcHJvdmlkZXIuc2VydmljZVRva2VuLFxuICAgICAgcmVzb3VyY2VUeXBlOiBUUkFGRklDX1NISUZUX1JFU09VUkNFX1RZUEUsXG4gICAgICBwcm9wZXJ0aWVzOiB7IC4uLnByb3BlcnRpZXMgfSxcbiAgICAgIC8vIENsb3VkRm9ybWF0aW9uJ3MgbWF4aW11bTsgdGhlIHByb3ZpZGVyIGZhaWxzIHRoZSBkZXBsb3ltZW50IGl0c2VsZiBhZnRlciA1NSBtaW51dGVzLlxuICAgICAgc2VydmljZVRpbWVvdXQ6IER1cmF0aW9uLmhvdXJzKDEpLFxuICAgIH0pO1xuICB9XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHJhZmZpYy1zaGlmdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9wcml2YXRlL3RyYWZmaWMtc2hpZnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsNkNBQXlDO0FBQ3pDLGdEQUFrQztBQUNsQyw2Q0FBMEc7QUFDMUcseURBQTJDO0FBQzNDLCtEQUFpRDtBQUNqRCwyREFBNkM7QUFDN0MsaUVBQW1EO0FBQ25ELDJDQUF1QztBQUN2QywrQkFBb0U7QUFDcEUsMkRBQStGO0FBRy9GLDJJQUEySTtBQUMzSSxNQUFNLGFBQWEsR0FBRyxzQkFBUSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUMzQyxNQUFNLFdBQVcsR0FBRyw2QkFBNkIsQ0FBQztBQUVsRDs7OztHQUlHO0FBQ0gsTUFBTSxrQkFBbUIsU0FBUSxzQkFBUztJQUNqQyxNQUFNLENBQUMsRUFBRSxDQUFDLEtBQWdCO1FBQy9CLE1BQU0sS0FBSyxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzlCLE9BQVEsS0FBSyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFvQyxJQUFJLElBQUksa0JBQWtCLENBQUMsS0FBSyxFQUFFLFdBQVcsQ0FBQyxDQUFDO0lBQ2hJLENBQUM7SUFFZSxZQUFZLENBQVM7SUFDcEIsSUFBSSxDQUFXO0lBQ2YsT0FBTyxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7SUFFN0MsWUFBb0IsS0FBZ0IsRUFBRSxFQUFVO1FBQzlDLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDakIsTUFBTSxRQUFRLEdBQUcsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxNQUFNLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDLGFBQWEsQ0FBQyxTQUFTLEVBQUUsYUFBYSxFQUFFLDJCQUFhLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUNwSSxJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLHNCQUFzQixDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3hHLHdGQUF3RjtRQUN4RixJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsT0FBTyxFQUFFLENBQUMsc0JBQXNCLEVBQUUsbUJBQW1CLENBQUMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzFHLGtGQUFrRjtRQUNsRixJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsT0FBTyxFQUFFLENBQUMsK0JBQStCLENBQUMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDaEcsaUVBQWlFO1FBQ2pFLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxPQUFPLEVBQUUsQ0FBQywyQkFBMkIsQ0FBQyxFQUFFLFNBQVMsRUFBRSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6RSxNQUFNLE9BQU8sR0FBRyxDQUFDLElBQVksRUFBRSxXQUFtQixFQUFFLFdBQW1CLEVBQUUsRUFBRSxDQUFDLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsSUFBSSxFQUFFO1lBQzFHLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTyxDQUFDLFdBQVc7WUFDbkMsWUFBWSxFQUFFLE1BQU0sQ0FBQyxZQUFZLENBQUMsTUFBTTtZQUN4QyxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUseUJBQXlCLENBQUMsQ0FBQztZQUNsRyxPQUFPLEVBQUUsU0FBUyxXQUFXLEVBQUU7WUFDL0IsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJO1lBQ2Ysc0dBQXNHO1lBQ3RHLE9BQU8sRUFBRSxzQkFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7WUFDNUIsVUFBVSxFQUFFLEdBQUc7WUFDZixRQUFRO1lBQ1IsV0FBVztTQUNaLENBQUMsQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLElBQUksRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsVUFBVSxFQUFFO1lBQ2pELGNBQWMsRUFBRSxPQUFPLENBQUMsU0FBUyxFQUFFLFNBQVMsRUFBRSx1RUFBdUUsQ0FBQztZQUN0SCxpQkFBaUIsRUFBRSxPQUFPLENBQUMsWUFBWSxFQUFFLFlBQVksRUFBRSw0RUFBNEUsQ0FBQztZQUNwSSxhQUFhLEVBQUUsc0JBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ25DLFlBQVksRUFBRSxhQUFhO1lBQzNCLFFBQVE7U0FDVCxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsWUFBWSxHQUFHLFFBQVEsQ0FBQyxZQUFZLENBQUM7UUFFMUMsSUFBQSw0QkFBc0IsRUFBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLENBQUMsSUFBSSxDQUFDLFlBQTJCLEVBQy9GLGlKQUFpSixDQUFDLENBQUM7UUFDckosSUFBQSx5QkFBbUIsRUFBQyxRQUFRLEVBQUUsc0ZBQXNGLEVBQUU7WUFDcEgsa0NBQWtDLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSxrQkFBa0IsQ0FBQztTQUM3RSxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLFNBQXFEO1FBQ2hFLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFDOUQsSUFBSSxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUM7WUFBRSxPQUFPO1FBQ2xDLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3RCLElBQUksQ0FBQyxJQUFJLENBQUMsb0JBQW9CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7SUFDckUsQ0FBQztDQUNGO0FBZUQ7O0dBRUc7QUFDSCxNQUFhLFlBQWEsU0FBUSxzQkFBUztJQUN6QixRQUFRLENBQWlCO0lBRXpDLFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBd0I7UUFDaEUsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztRQUNqQixNQUFNLEtBQUssR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM3QixNQUFNLFFBQVEsR0FBRyxrQkFBa0IsQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDN0MsTUFBTSxXQUFXLEdBQUcsS0FBSyxDQUFDLFNBQVMsQ0FBQztZQUNsQyxPQUFPLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxjQUFjLEVBQUUsWUFBWSxFQUFFLEtBQUssQ0FBQyxZQUFZLEVBQUUsU0FBUyxFQUFFLHVCQUFTLENBQUMsbUJBQW1CO1NBQ3hILENBQUMsQ0FBQztRQUNILG1GQUFtRjtRQUNuRixRQUFRLENBQUMsS0FBSyxDQUFDO1lBQ2IsT0FBTyxFQUFFLENBQUMsK0JBQStCLEVBQUUsa0NBQWtDLENBQUM7WUFDOUUsU0FBUyxFQUFFLENBQUMsV0FBVyxFQUFFLEdBQUcsV0FBVyxhQUFhLEVBQUUsR0FBRyxXQUFXLGFBQWEsQ0FBQztTQUNuRixDQUFDLENBQUM7UUFFSCxNQUFNLFVBQVUsR0FBRyxLQUFLLENBQUMsVUFBVSxDQUFDO1FBQ3BDLE1BQU0sU0FBUyxHQUFHLENBQUMsR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxLQUFLLENBQUMsU0FBUyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDN0YsTUFBTSxVQUFVLEdBQTJCO1lBQ3pDLFdBQVcsRUFBRSxLQUFLLENBQUMsV0FBVztZQUM5QixZQUFZLEVBQUUsS0FBSyxDQUFDLFlBQVk7WUFDaEMsVUFBVSxFQUFFLEtBQUssQ0FBQyxVQUFVO1lBQzVCLEtBQUssRUFBRSxVQUFVLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUM7WUFDbEMsV0FBVyxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDO1lBQzVDLFNBQVMsRUFBRSxTQUFTLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTO1lBQ3ZELGNBQWMsRUFBRSxJQUFBLHdCQUFVLEVBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQztTQUM1SCxDQUFDO1FBQ0YsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLDRCQUFjLENBQUMsSUFBSSxFQUFFLFVBQVUsRUFBRTtZQUNuRCxZQUFZLEVBQUUsUUFBUSxDQUFDLFlBQVk7WUFDbkMsWUFBWSxFQUFFLCtDQUEyQjtZQUN6QyxVQUFVLEVBQUUsRUFBRSxHQUFHLFVBQVUsRUFBRTtZQUM3Qix1RkFBdUY7WUFDdkYsY0FBYyxFQUFFLHNCQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztTQUNsQyxDQUFDLENBQUM7SUFDTCxDQUFDO0NBQ0Y7QUFuQ0Qsb0NBbUNDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgY3JlYXRlSGFzaCB9IGZyb20gJ25vZGU6Y3J5cHRvJztcbmltcG9ydCAqIGFzIHBhdGggZnJvbSAnbm9kZTpwYXRoJztcbmltcG9ydCB7IEFybkZvcm1hdCwgdHlwZSBDZm5SZXNvdXJjZSwgQ3VzdG9tUmVzb3VyY2UsIER1cmF0aW9uLCBSZW1vdmFsUG9saWN5LCBTdGFjayB9IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCAqIGFzIGlhbSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCAqIGFzIGxhbWJkYSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtbGFtYmRhJztcbmltcG9ydCAqIGFzIGxvZ3MgZnJvbSAnYXdzLWNkay1saWIvYXdzLWxvZ3MnO1xuaW1wb3J0ICogYXMgY3IgZnJvbSAnYXdzLWNkay1saWIvY3VzdG9tLXJlc291cmNlcyc7XG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7IGFja25vd2xlZGdlSWFtRmluZGluZ3MsIGFja25vd2xlZGdlTmFnVW5kZXIgfSBmcm9tICcuL25hZyc7XG5pbXBvcnQgeyBUUkFGRklDX1NISUZUX1JFU09VUkNFX1RZUEUsIHR5cGUgVHJhZmZpY1NoaWZ0UHJvcGVydGllcyB9IGZyb20gJy4vcHJvdmlkZXItcHJvdG9jb2wnO1xuaW1wb3J0IHR5cGUgeyBXZWJGdW5jdGlvbkRlcGxveW1lbnQgfSBmcm9tICcuLi93ZWItZnVuY3Rpb24tZGVwbG95bWVudCc7XG5cbi8qKiBUaGUgUHJvdmlkZXIgZnJhbWV3b3JrIGdpdmVzIHVwIGFmdGVyIHRoaXMgbG9uZyBhbmQgZmFpbHMgdGhlIGRlcGxveW1lbnQgKHdpdGggYSBtZXNzYWdlKSwgYmVmb3JlIENsb3VkRm9ybWF0aW9uJ3Mgb3duIDEtaG91ciBsaW1pdC4gKi9cbmNvbnN0IFRPVEFMX1RJTUVPVVQgPSBEdXJhdGlvbi5taW51dGVzKDU1KTtcbmNvbnN0IFBST1ZJREVSX0lEID0gJ0xhbWJkYVdlYkRlcGxveW1lbnRQcm92aWRlcic7XG5cbi8qKlxuICogVGhlIHN0YWNrJ3MgZGVwbG95bWVudCBwcm92aWRlcjogYSBDREsgUHJvdmlkZXIgZnJhbWV3b3JrIChhIFN0ZXAgRnVuY3Rpb25zIHdhaXRlcikgYXJvdW5kIGBvbkV2ZW50YCBhbmQgYGlzQ29tcGxldGVgXG4gKiBmcm9tIGBoYW5kbGVycy93ZWItZnVuY3Rpb24tZGVwbG95bWVudGAsIGJlY2F1c2UgYSBjYW5hcnkgb3IgbGluZWFyIGRlcGxveW1lbnQgY2FuIHJ1biBmb3IgdXAgdG8gYW4gaG91ci5cbiAqIE9uZSBwZXIgc3RhY2ssIHNoYXJlZCBieSBldmVyeSBlbmRwb2ludCB0aGF0IGRlcGxveXMgaW4gc3RlcHMuXG4gKi9cbmNsYXNzIERlcGxveW1lbnRQcm92aWRlciBleHRlbmRzIENvbnN0cnVjdCB7XG4gIHB1YmxpYyBzdGF0aWMgb2Yoc2NvcGU6IENvbnN0cnVjdCk6IERlcGxveW1lbnRQcm92aWRlciB7XG4gICAgY29uc3Qgc3RhY2sgPSBTdGFjay5vZihzY29wZSk7XG4gICAgcmV0dXJuIChzdGFjay5ub2RlLnRyeUZpbmRDaGlsZChQUk9WSURFUl9JRCkgYXMgRGVwbG95bWVudFByb3ZpZGVyIHwgdW5kZWZpbmVkKSA/PyBuZXcgRGVwbG95bWVudFByb3ZpZGVyKHN0YWNrLCBQUk9WSURFUl9JRCk7XG4gIH1cblxuICBwdWJsaWMgcmVhZG9ubHkgc2VydmljZVRva2VuOiBzdHJpbmc7XG4gIHByaXZhdGUgcmVhZG9ubHkgcm9sZTogaWFtLlJvbGU7XG4gIHByaXZhdGUgcmVhZG9ubHkgZ3JhbnRlZCA9IG5ldyBTZXQ8c3RyaW5nPigpO1xuXG4gIHByaXZhdGUgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG4gICAgY29uc3QgbG9nR3JvdXAgPSBuZXcgbG9ncy5Mb2dHcm91cCh0aGlzLCAnTG9ncycsIHsgcmV0ZW50aW9uOiBsb2dzLlJldGVudGlvbkRheXMuT05FX01PTlRILCByZW1vdmFsUG9saWN5OiBSZW1vdmFsUG9saWN5LkRFU1RST1kgfSk7XG4gICAgdGhpcy5yb2xlID0gbmV3IGlhbS5Sb2xlKHRoaXMsICdSb2xlJywgeyBhc3N1bWVkQnk6IG5ldyBpYW0uU2VydmljZVByaW5jaXBhbCgnbGFtYmRhLmFtYXpvbmF3cy5jb20nKSB9KTtcbiAgICAvLyBJdHMgb3duIGxvZyBncm91cCBvbmx5IChub3QgQVdTTGFtYmRhQmFzaWNFeGVjdXRpb25Sb2xlLCB3aGljaCBjYW4gY3JlYXRlIGFueSBncm91cCkuXG4gICAgdGhpcy5ncmFudCh7IGFjdGlvbnM6IFsnbG9nczpDcmVhdGVMb2dTdHJlYW0nLCAnbG9nczpQdXRMb2dFdmVudHMnXSwgcmVzb3VyY2VzOiBbbG9nR3JvdXAubG9nR3JvdXBBcm5dIH0pO1xuICAgIC8vIFJvbGxiYWNrIGRldGVjdGlvbjogaXMgdGhlIHN0YWNrIHJvbGxpbmcgYmFjaz8gKHRoZSBwcm92aWRlcidzIG93biBzdGFjayBvbmx5KS5cbiAgICB0aGlzLmdyYW50KHsgYWN0aW9uczogWydjbG91ZGZvcm1hdGlvbjpEZXNjcmliZVN0YWNrcyddLCByZXNvdXJjZXM6IFtTdGFjay5vZih0aGlzKS5zdGFja0lkXSB9KTtcbiAgICAvLyBDb21wb3NpdGUgYWxhcm1zIGFyZSBvbmx5IHJldHVybmVkIHdpdGggRGVzY3JpYmVBbGFybXMgb24gJyonLlxuICAgIHRoaXMuZ3JhbnQoeyBhY3Rpb25zOiBbJ2Nsb3Vkd2F0Y2g6RGVzY3JpYmVBbGFybXMnXSwgcmVzb3VyY2VzOiBbJyonXSB9KTtcbiAgICBjb25zdCBoYW5kbGVyID0gKG5hbWU6IHN0cmluZywgaGFuZGxlck5hbWU6IHN0cmluZywgZGVzY3JpcHRpb246IHN0cmluZykgPT4gbmV3IGxhbWJkYS5GdW5jdGlvbih0aGlzLCBuYW1lLCB7XG4gICAgICBydW50aW1lOiBsYW1iZGEuUnVudGltZS5OT0RFSlNfMjRfWCxcbiAgICAgIGFyY2hpdGVjdHVyZTogbGFtYmRhLkFyY2hpdGVjdHVyZS5BUk1fNjQsXG4gICAgICBjb2RlOiBsYW1iZGEuQ29kZS5mcm9tQXNzZXQocGF0aC5qb2luKF9fZGlybmFtZSwgJy4uJywgJy4uJywgJ2Fzc2V0cycsICd3ZWItZnVuY3Rpb24tZGVwbG95bWVudCcpKSxcbiAgICAgIGhhbmRsZXI6IGBpbmRleC4ke2hhbmRsZXJOYW1lfWAsXG4gICAgICByb2xlOiB0aGlzLnJvbGUsXG4gICAgICAvLyBpc0NvbXBsZXRlIHdhaXRzIHVwIHRvIDUgbWludXRlcyBmb3IgYSByZXN0b3JlIHRvIHJlYWNoIGV2ZXJ5IHJlZ2lvbiBiZWZvcmUgZmFpbGluZyB0aGUgZGVwbG95bWVudC5cbiAgICAgIHRpbWVvdXQ6IER1cmF0aW9uLm1pbnV0ZXMoNyksXG4gICAgICBtZW1vcnlTaXplOiAyNTYsXG4gICAgICBsb2dHcm91cCxcbiAgICAgIGRlc2NyaXB0aW9uLFxuICAgIH0pO1xuICAgIGNvbnN0IHByb3ZpZGVyID0gbmV3IGNyLlByb3ZpZGVyKHRoaXMsICdQcm92aWRlcicsIHtcbiAgICAgIG9uRXZlbnRIYW5kbGVyOiBoYW5kbGVyKCdPbkV2ZW50JywgJ29uRXZlbnQnLCAnU3RhcnRzIGNhbmFyeSBhbmQgbGluZWFyIGRlcGxveW1lbnRzIG9mIExhbWJkYSBXZWIgRnVuY3Rpb24gZW5kcG9pbnRzJyksXG4gICAgICBpc0NvbXBsZXRlSGFuZGxlcjogaGFuZGxlcignSXNDb21wbGV0ZScsICdpc0NvbXBsZXRlJywgJ01vdmVzIExhbWJkYSBXZWIgRnVuY3Rpb24gZW5kcG9pbnQgdHJhZmZpYyBzdGVwIGJ5IHN0ZXAgYW5kIHdhdGNoZXMgYWxhcm1zJyksXG4gICAgICBxdWVyeUludGVydmFsOiBEdXJhdGlvbi5zZWNvbmRzKDE1KSxcbiAgICAgIHRvdGFsVGltZW91dDogVE9UQUxfVElNRU9VVCxcbiAgICAgIGxvZ0dyb3VwLFxuICAgIH0pO1xuICAgIHRoaXMuc2VydmljZVRva2VuID0gcHJvdmlkZXIuc2VydmljZVRva2VuO1xuXG4gICAgYWNrbm93bGVkZ2VJYW1GaW5kaW5ncyh0aGlzLnJvbGUubm9kZS5maW5kQ2hpbGQoJ0RlZmF1bHRQb2xpY3knKS5ub2RlLmRlZmF1bHRDaGlsZCBhcyBDZm5SZXNvdXJjZSxcbiAgICAgICdUaGUgZGVwbG95bWVudCBoYW5kbGVyc1xcJyBvd24gbG9nIGdyb3VwLCBEZXNjcmliZUFsYXJtcyAoY29tcG9zaXRlIGFsYXJtcyBuZWVkICopLCBhbmQgdGhlIHJldmlzaW9ucyBhbmQgZW5kcG9pbnRzIG9mIHRoZSBmdW5jdGlvbnMgdGhleSBkZXBsb3knKTtcbiAgICBhY2tub3dsZWRnZU5hZ1VuZGVyKHByb3ZpZGVyLCAnVGhlIENESyBjdXN0b20gcmVzb3VyY2UgUHJvdmlkZXIgZnJhbWV3b3JrXFwncyBvd24gZnVuY3Rpb25zIGFuZCB3YWl0ZXIgc3RhdGUgbWFjaGluZScsIHtcbiAgICAgICdBV1M6OlN0ZXBGdW5jdGlvbnM6OlN0YXRlTWFjaGluZSc6IFsnQXdzU29sdXRpb25zLVNGMScsICdBd3NTb2x1dGlvbnMtU0YyJ10sXG4gICAgfSk7XG4gIH1cblxuICAvKipcbiAgICogQWRkcyBhIHN0YXRlbWVudCB0byB0aGUgaGFuZGxlcnMnIHJvbGUsIG9uY2UuIExpa2UgdGhlIHNoYXJlZCBwcm92aWRlcidzIGdyYW50cywgdGhleSBtdXN0IGJlIHN0YWJsZSBhY3Jvc3NcbiAgICogdXBkYXRlcyAocHJlZml4ZXMsIG5vdCBuYW1lcyB0aGF0IGNoYW5nZSkgYW5kIG5ldmVyIHJlZmVyZW5jZSBhdHRyaWJ1dGVzIG9mIHJlc291cmNlcyB0aGF0IHVzZSB0aGUgcHJvdmlkZXIuXG4gICAqL1xuICBwdWJsaWMgZ3JhbnQoc3RhdGVtZW50OiB7IGFjdGlvbnM6IHN0cmluZ1tdOyByZXNvdXJjZXM6IHN0cmluZ1tdIH0pOiB2b2lkIHtcbiAgICBjb25zdCBrZXkgPSBKU09OLnN0cmluZ2lmeShTdGFjay5vZih0aGlzKS5yZXNvbHZlKHN0YXRlbWVudCkpO1xuICAgIGlmICh0aGlzLmdyYW50ZWQuaGFzKGtleSkpIHJldHVybjtcbiAgICB0aGlzLmdyYW50ZWQuYWRkKGtleSk7XG4gICAgdGhpcy5yb2xlLmFkZFRvUHJpbmNpcGFsUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHN0YXRlbWVudCkpO1xuICB9XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgVHJhZmZpY1NoaWZ0UHJvcHMge1xuICAvKiogTGl0ZXJhbCBmdW5jdGlvbiBuYW1lLCBmb3Igc3RhYmxlIElBTSBncmFudHMuICovXG4gIHJlYWRvbmx5IGZ1bmN0aW9uTmFtZTogc3RyaW5nO1xuICByZWFkb25seSBmdW5jdGlvbkFybjogc3RyaW5nO1xuICByZWFkb25seSBlbmRwb2ludE5hbWU6IHN0cmluZztcbiAgcmVhZG9ubHkgcmV2aXNpb25JZDogc3RyaW5nO1xuICByZWFkb25seSBkZXBsb3ltZW50OiBXZWJGdW5jdGlvbkRlcGxveW1lbnQ7XG4gIC8qKiBBUk5zIG9mIGFsYXJtcyB0aGUgZW5kcG9pbnQgY3JlYXRlZCAoYHJvbGxiYWNrT25gKSwgd2F0Y2hlZCB3aXRoIHRoZSBkZXBsb3ltZW50J3Mgb3duIGBhbGFybXNgLiAqL1xuICByZWFkb25seSBhbGFybUFybnM/OiBzdHJpbmdbXTtcbiAgLyoqIFRoZSBlbmRwb2ludCdzIG90aGVyIHNldHRpbmdzOiBhbnkgY2hhbmdlIG1ha2VzIHRoZSBzaGlmdCBydW4sIHNvIGl0IGNhbiByZS1jaGVjayB0aGUgdHJhZmZpYyBiZWZvcmUgQ2xvdWRGb3JtYXRpb24gd3JpdGVzIGl0LiAqL1xuICByZWFkb25seSBlbmRwb2ludENvbmZpZzogdW5rbm93bjtcbn1cblxuLyoqXG4gKiBNb3ZlcyBhbiBlbmRwb2ludCdzIHRyYWZmaWMgdG8gYHJldmlzaW9uSWRgIGluIHN0ZXBzIGJlZm9yZSBDbG91ZEZvcm1hdGlvbiB1cGRhdGVzIHRoZSBlbmRwb2ludCAod2hpY2ggbXVzdCBkZXBlbmQgb24gaXQpLlxuICovXG5leHBvcnQgY2xhc3MgVHJhZmZpY1NoaWZ0IGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgcHVibGljIHJlYWRvbmx5IHJlc291cmNlOiBDdXN0b21SZXNvdXJjZTtcblxuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogVHJhZmZpY1NoaWZ0UHJvcHMpIHtcbiAgICBzdXBlcihzY29wZSwgaWQpO1xuICAgIGNvbnN0IHN0YWNrID0gU3RhY2sub2YodGhpcyk7XG4gICAgY29uc3QgcHJvdmlkZXIgPSBEZXBsb3ltZW50UHJvdmlkZXIub2YodGhpcyk7XG4gICAgY29uc3QgZnVuY3Rpb25Bcm4gPSBzdGFjay5mb3JtYXRBcm4oe1xuICAgICAgc2VydmljZTogJ2xhbWJkYScsIHJlc291cmNlOiAnd2ViLWZ1bmN0aW9uJywgcmVzb3VyY2VOYW1lOiBwcm9wcy5mdW5jdGlvbk5hbWUsIGFybkZvcm1hdDogQXJuRm9ybWF0LlNMQVNIX1JFU09VUkNFX05BTUUsXG4gICAgfSk7XG4gICAgLy8gU3RhYmxlIGdyYW50IChzZWUgZ3JhbnRUb1Byb3ZpZGVyKTogZXZlcnkgZW5kcG9pbnQgYW5kIHJldmlzaW9uIG9mIHRoZSBmdW5jdGlvbi5cbiAgICBwcm92aWRlci5ncmFudCh7XG4gICAgICBhY3Rpb25zOiBbJ2xhbWJkYTpHZXRXZWJGdW5jdGlvbkVuZHBvaW50JywgJ2xhbWJkYTpVcGRhdGVXZWJGdW5jdGlvbkVuZHBvaW50J10sXG4gICAgICByZXNvdXJjZXM6IFtmdW5jdGlvbkFybiwgYCR7ZnVuY3Rpb25Bcm59L2VuZHBvaW50LypgLCBgJHtmdW5jdGlvbkFybn0vcmV2aXNpb24vKmBdLFxuICAgIH0pO1xuXG4gICAgY29uc3QgZGVwbG95bWVudCA9IHByb3BzLmRlcGxveW1lbnQ7XG4gICAgY29uc3QgYWxhcm1Bcm5zID0gWy4uLmRlcGxveW1lbnQuX2FsYXJtcy5tYXAoKGEpID0+IGEuYWxhcm1Bcm4pLCAuLi4ocHJvcHMuYWxhcm1Bcm5zID8/IFtdKV07XG4gICAgY29uc3QgcHJvcGVydGllczogVHJhZmZpY1NoaWZ0UHJvcGVydGllcyA9IHtcbiAgICAgIEZ1bmN0aW9uQXJuOiBwcm9wcy5mdW5jdGlvbkFybixcbiAgICAgIEVuZHBvaW50TmFtZTogcHJvcHMuZW5kcG9pbnROYW1lLFxuICAgICAgUmV2aXNpb25JZDogcHJvcHMucmV2aXNpb25JZCxcbiAgICAgIFN0ZXBzOiBkZXBsb3ltZW50Ll9zdGVwcy5qb2luKCcsJyksXG4gICAgICBXYWl0U2Vjb25kczogU3RyaW5nKGRlcGxveW1lbnQuX3dhaXRTZWNvbmRzKSxcbiAgICAgIEFsYXJtQXJuczogYWxhcm1Bcm5zLmxlbmd0aCA+IDAgPyBhbGFybUFybnMgOiB1bmRlZmluZWQsXG4gICAgICBFbmRwb2ludENvbmZpZzogY3JlYXRlSGFzaCgnc2hhMjU2JykudXBkYXRlKEpTT04uc3RyaW5naWZ5KHN0YWNrLnJlc29sdmUocHJvcHMuZW5kcG9pbnRDb25maWcpKSkuZGlnZXN0KCdoZXgnKS5zbGljZSgwLCAxNiksXG4gICAgfTtcbiAgICB0aGlzLnJlc291cmNlID0gbmV3IEN1c3RvbVJlc291cmNlKHRoaXMsICdSZXNvdXJjZScsIHtcbiAgICAgIHNlcnZpY2VUb2tlbjogcHJvdmlkZXIuc2VydmljZVRva2VuLFxuICAgICAgcmVzb3VyY2VUeXBlOiBUUkFGRklDX1NISUZUX1JFU09VUkNFX1RZUEUsXG4gICAgICBwcm9wZXJ0aWVzOiB7IC4uLnByb3BlcnRpZXMgfSxcbiAgICAgIC8vIENsb3VkRm9ybWF0aW9uJ3MgbWF4aW11bTsgdGhlIHByb3ZpZGVyIGZhaWxzIHRoZSBkZXBsb3ltZW50IGl0c2VsZiBhZnRlciA1NSBtaW51dGVzLlxuICAgICAgc2VydmljZVRpbWVvdXQ6IER1cmF0aW9uLmhvdXJzKDEpLFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/web-function-deployment.js

@@ -11,7 +11,7 @@ const MAX_STEPS = 20;
  * How an endpoint moves its traffic to a new revision.
  */
 class WebFunctionDeployment {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionDeployment", version: "0.1.7" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionDeployment", version: "0.1.9" };
     /**
      * All traffic moves to the new revision at once, as soon as it's ready (the default).
      */

package/lib/web-function-endpoint.js

@@ -53,7 +53,7 @@ const web_function_grants_1 = require("./web-function-grants");
  * Endpoints are created only through `WebFunction`, which owns their log groups in every region, so the constructor is private.
  */
 class WebFunctionEndpoint extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint", version: "0.1.7" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint", version: "0.1.9" };
     /**
      * Creates an endpoint of a Web Function. Used by `WebFunction`.
      *