@aws-amplify/graphql-api-construct 1.6.0 → 1.7.0-cors-rule.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-amplify/graphql-api-construct",
-  "version": "1.6.0",
+  "version": "1.7.0-cors-rule.0",
   "description": "AppSync GraphQL Api Construct using Amplify GraphQL Transformer.",
   "repository": {
     "type": "git",
@@ -75,20 +75,20 @@
   "dependencies": {
     "@aws-amplify/backend-output-schemas": "^0.4.0",
     "@aws-amplify/backend-output-storage": "^0.2.2",
-    "@aws-amplify/graphql-auth-transformer": "3.4.1",
-    "@aws-amplify/graphql-default-value-transformer": "2.3.1",
-    "@aws-amplify/graphql-function-transformer": "2.1.18",
-    "@aws-amplify/graphql-http-transformer": "2.1.18",
-    "@aws-amplify/graphql-index-transformer": "2.3.7",
-    "@aws-amplify/graphql-maps-to-transformer": "3.4.8",
-    "@aws-amplify/graphql-model-transformer": "2.6.0",
-    "@aws-amplify/graphql-predictions-transformer": "2.1.18",
-    "@aws-amplify/graphql-relational-transformer": "2.4.1",
-    "@aws-amplify/graphql-searchable-transformer": "2.6.1",
-    "@aws-amplify/graphql-sql-transformer": "0.2.7",
-    "@aws-amplify/graphql-transformer": "1.3.12",
-    "@aws-amplify/graphql-transformer-core": "2.5.0",
-    "@aws-amplify/graphql-transformer-interfaces": "3.4.0",
+    "@aws-amplify/graphql-auth-transformer": "3.4.2-cors-rule.0",
+    "@aws-amplify/graphql-default-value-transformer": "2.3.2-cors-rule.0",
+    "@aws-amplify/graphql-function-transformer": "2.1.19-cors-rule.0",
+    "@aws-amplify/graphql-http-transformer": "2.1.19-cors-rule.0",
+    "@aws-amplify/graphql-index-transformer": "2.3.8-cors-rule.0",
+    "@aws-amplify/graphql-maps-to-transformer": "3.4.9-cors-rule.0",
+    "@aws-amplify/graphql-model-transformer": "2.7.0-cors-rule.0",
+    "@aws-amplify/graphql-predictions-transformer": "2.1.19-cors-rule.0",
+    "@aws-amplify/graphql-relational-transformer": "2.4.2-cors-rule.0",
+    "@aws-amplify/graphql-searchable-transformer": "2.6.2-cors-rule.0",
+    "@aws-amplify/graphql-sql-transformer": "0.2.8-cors-rule.0",
+    "@aws-amplify/graphql-transformer": "1.4.0-cors-rule.0",
+    "@aws-amplify/graphql-transformer-core": "2.5.1-cors-rule.0",
+    "@aws-amplify/graphql-transformer-interfaces": "3.5.0-cors-rule.0",
     "@aws-amplify/platform-core": "^0.2.0",
     "@aws-amplify/plugin-types": "^0.4.1",
     "charenc": "^0.0.2",
@@ -112,7 +112,7 @@
     "zod": "^3.22.3"
   },
   "devDependencies": {
-    "@aws-amplify/graphql-transformer-test-utils": "0.4.6",
+    "@aws-amplify/graphql-transformer-test-utils": "0.4.7-cors-rule.0",
     "@types/fs-extra": "^8.0.1",
     "@types/node": "^12.12.6",
     "aws-cdk-lib": "2.80.0",
@@ -177,5 +177,5 @@
       "/__tests__/"
     ]
   },
-  "gitHead": "9a0fb53d5df94e76811cbbdc4f3fc98fc6278c41"
+  "gitHead": "8a673ad53fc3116a79c6ce1d52a1113eb0160e9b"
 }

package/src/internal/codegen-assets.ts

@@ -1,5 +1,5 @@
-import { RemovalPolicy } from 'aws-cdk-lib';
-import { Bucket, IBucket } from 'aws-cdk-lib/aws-s3';
+import { RemovalPolicy, Fn } from 'aws-cdk-lib';
+import { Bucket, HttpMethods, IBucket } from 'aws-cdk-lib/aws-s3';
 import { BucketDeployment, Source } from 'aws-cdk-lib/aws-s3-deployment';
 import { Construct } from 'constructs';
 
@@ -8,6 +8,11 @@ export type CodegenAssetsProps = {
 };
 
 const MODEL_SCHEMA_KEY = 'model-schema.graphql';
+const CONSOLE_SERVICE_ENDPOINT = Fn.join('', [
+  'https://',
+  Fn.ref('AWS::Region'),
+  '.console.aws.amazon.com/amplify',
+]);
 
 /**
  * Construct an S3 URI string for a given bucket and key.
@@ -30,6 +35,14 @@ export class CodegenAssets extends Construct {
     const bucket = new Bucket(this, `${id}Bucket`, {
       removalPolicy: RemovalPolicy.DESTROY,
       autoDeleteObjects: true,
+      // Enabling CORS to allow console to access the codegen assets.
+      cors: [
+        {
+          allowedMethods: [HttpMethods.GET, HttpMethods.HEAD],
+          allowedHeaders: ['*'],
+          allowedOrigins: [CONSOLE_SERVICE_ENDPOINT],
+        },
+      ],
     });
 
     const deployment = new BucketDeployment(this, `${id}Deployment`, {

package/src/internal/data-source-config.ts

@@ -6,7 +6,12 @@ import {
   isMutationNode,
   fieldsWithSqlDirective,
 } from '@aws-amplify/graphql-transformer-core';
-import { DataSourceStrategiesProvider } from '@aws-amplify/graphql-transformer-interfaces';
+import {
+  DataSourceStrategiesProvider,
+  isSqlModelDataSourceSsmDbConnectionConfig,
+  isSqlModelDataSourceSecretsManagerDbConnectionConfig,
+} from '@aws-amplify/graphql-transformer-interfaces';
+import { Token, Arn, ArnFormat } from 'aws-cdk-lib';
 import {
   CustomSqlDataSourceStrategy as ConstructCustomSqlDataSourceStrategy,
   ModelDataSourceStrategy as ConstructModelDataSourceStrategy,
@@ -184,19 +189,47 @@ export const schemaByMergingDefinitions = (definitions: IAmplifyGraphqlDefinitio
  * @param strategy user provided model data source strategy
  * @returns validates and throws an error if the strategy is invalid
  */
-export const validateDataSourceStrategy = (strategy: ConstructModelDataSourceStrategy) => {
+export const validateDataSourceStrategy = (strategy: ConstructModelDataSourceStrategy): void => {
   if (!isSqlStrategy(strategy)) {
     return;
   }
 
   const dbConnectionConfig = strategy.dbConnectionConfig;
-  const invalidSSMPaths = Object.values(dbConnectionConfig).filter((value) => typeof value === 'string' && !isValidSSMPath(value));
-  if (invalidSSMPaths.length > 0) {
-    throw new Error(
-      `Invalid data source strategy "${
-        strategy.name
-      }". Following SSM paths must start with '/' in dbConnectionConfig: ${invalidSSMPaths.join(', ')}.`,
-    );
+  if (isSqlModelDataSourceSsmDbConnectionConfig(dbConnectionConfig)) {
+    const invalidSSMPaths = Object.values(dbConnectionConfig).filter((value) => typeof value === 'string' && !isValidSSMPath(value));
+    if (invalidSSMPaths.length > 0) {
+      throw new Error(
+        `Invalid data source strategy "${
+          strategy.name
+        }". Following SSM paths must start with '/' in dbConnectionConfig: ${invalidSSMPaths.join(', ')}.`,
+      );
+    }
+  } else if (isSqlModelDataSourceSecretsManagerDbConnectionConfig(dbConnectionConfig)) {
+    if (!Token.isUnresolved(dbConnectionConfig.secretArn)) {
+      try {
+        const arnComponents = Arn.split(dbConnectionConfig.secretArn, ArnFormat.COLON_RESOURCE_NAME);
+        if (arnComponents.service !== 'secretsmanager' || arnComponents.resource !== 'secret') {
+          // error message does not matter because it inside try/catch
+          throw new Error();
+        }
+      } catch {
+        throw new Error(`Invalid data source strategy "${strategy.name}". The value of secretArn is not a valid Secrets Manager ARN.`);
+      }
+    }
+
+    if (dbConnectionConfig.keyArn && !Token.isUnresolved(dbConnectionConfig.keyArn)) {
+      try {
+        const arnComponents = Arn.split(dbConnectionConfig.keyArn, ArnFormat.SLASH_RESOURCE_NAME);
+        if (arnComponents.service !== 'kms' || arnComponents.resource !== 'key') {
+          // error message does not matter because it inside try/catch
+          throw new Error();
+        }
+      } catch {
+        throw new Error(`Invalid data source strategy "${strategy.name}". The value of keyArn is not a valid KMS ARN.`);
+      }
+    }
+  } else {
+    throw new Error(`Invalid data source strategy "${strategy.name}". dbConnectionConfig does not include SSM paths or Secret ARN.`);
   }
 };
 

package/src/model-datasource-strategy-types.ts

@@ -116,12 +116,44 @@ export interface SubnetAvailabilityZone {
   readonly availabilityZone: string;
 }
 
+/**
+ * The credentials the lambda data source will use to connect to the database.
+ *
+ * @experimental
+ */
+export type SqlModelDataSourceDbConnectionConfig =
+  | SqlModelDataSourceSecretsManagerDbConnectionConfig
+  | SqlModelDataSourceSsmDbConnectionConfig;
+
+/**
+ * The credentials stored in Secrets Manager that the lambda data source will use to connect to the database.
+ *
+ * The managed secret should be in the same region as the lambda.
+ * @experimental
+ */
+export interface SqlModelDataSourceSecretsManagerDbConnectionConfig {
+  /** The ARN of the managed secret with username, password, and hostname to use when connecting to the database. **/
+  readonly secretArn: string;
+
+  /** The ARN of the customer managed encryption key for the secret. If not supplied, the secret is expected to be encrypted with the default AWS-managed key. **/
+  readonly keyArn?: string;
+
+  /** The port number of the database proxy, cluster, or instance. */
+  readonly port: number;
+
+  /** The database name. */
+  readonly databaseName: string;
+
+  /** The hostame of the database. */
+  readonly hostname: string;
+}
+
 /**
  * The Secure Systems Manager parameter paths the Lambda data source will use to connect to the database.
  *
  * These parameters are retrieved from Secure Systems Manager in the same region as the Lambda.
  */
-export interface SqlModelDataSourceDbConnectionConfig {
+export interface SqlModelDataSourceSsmDbConnectionConfig {
   /** The Secure Systems Manager parameter containing the hostname of the database. For RDS-based SQL data sources, this can be the hostname
    * of a database proxy, cluster, or instance.
    */

package/src/sql-model-datasource-strategy.ts

@@ -1,7 +1,12 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { isSqlDbType } from '@aws-amplify/graphql-transformer-core';
-import { SQLLambdaModelDataSourceStrategy, SqlModelDataSourceDbConnectionConfig } from './model-datasource-strategy-types';
+import {
+  SQLLambdaModelDataSourceStrategy,
+  SqlModelDataSourceDbConnectionConfig,
+  SqlModelDataSourceSsmDbConnectionConfig,
+  SqlModelDataSourceSecretsManagerDbConnectionConfig,
+} from './model-datasource-strategy-types';
 
 /**
  * Type predicate that returns true if the object is a SQLLambdaModelDataSourceStrategy.
@@ -24,6 +29,15 @@ export const isSQLLambdaModelDataSourceStrategy = (obj: any): obj is SQLLambdaMo
  * @returns true if the object is shaped like a SqlModelDataSourceDbConnectionConfig
  */
 export const isSqlModelDataSourceDbConnectionConfig = (obj: any): obj is SqlModelDataSourceDbConnectionConfig => {
+  return isSqlModelDataSourceSsmDbConnectionConfig(obj) || isSqlModelDataSourceSecretsManagerDbConnectionConfig(obj);
+};
+
+/**
+ * Type predicate that returns true if the object is a SqlModelDataSourceSsmDbConnectionConfig.
+ * @param obj the object to inspect
+ * @returns true if the object is shaped like a SqlModelDataSourceSsmDbConnectionConfig
+ */
+export const isSqlModelDataSourceSsmDbConnectionConfig = (obj: any): obj is SqlModelDataSourceSsmDbConnectionConfig => {
   return (
     (typeof obj === 'object' || typeof obj === 'function') &&
     typeof obj.hostnameSsmPath === 'string' &&
@@ -34,6 +48,23 @@ export const isSqlModelDataSourceDbConnectionConfig = (obj: any): obj is SqlMode
   );
 };
 
+/**
+ * Type predicate that returns true if the object is a SqlModelDataSourceSecretsManagerDbConnectionConfig.
+ * @param obj the object to inspect
+ * @returns true if the object is shaped like a SqlModelDataSourceSecretsManagerDbConnectionConfig
+ */
+export const isSqlModelDataSourceSecretsManagerDbConnectionConfig = (
+  obj: any,
+): obj is SqlModelDataSourceSecretsManagerDbConnectionConfig => {
+  return (
+    (typeof obj === 'object' || typeof obj === 'function') &&
+    typeof obj.secretArn === 'string' &&
+    typeof obj.port === 'number' &&
+    typeof obj.databaseName === 'string' &&
+    typeof obj.hostname == 'string'
+  );
+};
+
 /**
  * Class exposing utilities to produce SQLLambdaModelDataSourceStrategy objects given various inputs.
  */