@aws-sdk/find-v2 0.6.0 → 0.7.0

package/README.md

@@ -33,17 +33,19 @@ Run `lambda` command to scan Lambda Node.js Functions for JavaScript SDK v2.
 
 ```console
 $ npx @aws-sdk/find-v2 lambda --yes --output table
-┌─────────────────────────────────────────┬───────────┬────────────┬────────────┬────────────────────────────────────────────────┐
-│ FunctionName                            │ Region    │ Runtime    │ SdkVersion │ ContainsAwsSdkJsV2                             │
-├─────────────────────────────────────────┼───────────┼────────────┼────────────┼────────────────────────────────────────────────┤
-│ fn-without-aws-sdk-in-bundle            │ us-east-2 │ nodejs24.x │ >=2.0.0    │ No.                                            │
-├─────────────────────────────────────────┼───────────┼────────────┼────────────┼────────────────────────────────────────────────┤
-│ fn-with-aws-sdk-in-bundle               │ us-east-2 │ nodejs24.x │ >=2.0.0    │ Yes. Bundled in 'index.js'                     │
-├─────────────────────────────────────────┼───────────┼────────────┼────────────┼────────────────────────────────────────────────┤
-│ fn-with-aws-sdk-in-package-json-deps    │ us-east-2 │ nodejs24.x │ >=2.0.0    │ Yes. Defined in dependencies of 'package.json' │
-├─────────────────────────────────────────┼───────────┼────────────┼────────────┼────────────────────────────────────────────────┤
-│ fn-without-aws-sdk-in-package-json-deps │ us-east-2 │ nodejs24.x │ >=2.0.0    │ No.                                            │
-└─────────────────────────────────────────┴───────────┴────────────┴────────────┴────────────────────────────────────────────────┘
+┌─────────────────────────────────────────┬───────────┬────────────┬────────────┬────────────────────┐
+│ FunctionName                            │ Region    │ Runtime    │ SdkVersion │ ContainsAwsSdkJsV2 │
+├─────────────────────────────────────────┼───────────┼────────────┼────────────┼────────────────────┤
+│ fn-without-aws-sdk-in-bundle            │ us-east-2 │ nodejs24.x │ >=2.0.0    │ No.                │
+├─────────────────────────────────────────┼───────────┼────────────┼────────────┼────────────────────┤
+│ fn-with-aws-sdk-in-bundle               │ us-east-2 │ nodejs24.x │ >=2.0.0    │ Yes. Found in:     │
+│                                         │           │            │            │ - index.js         │
+├─────────────────────────────────────────┼───────────┼────────────┼────────────┼────────────────────┤
+│ fn-with-aws-sdk-in-package-json-deps    │ us-east-2 │ nodejs24.x │ >=2.0.0    │ Yes. Found in:     │
+│                                         │           │            │            │ - index.mjs        │
+├─────────────────────────────────────────┼───────────┼────────────┼────────────┼────────────────────┤
+│ fn-without-aws-sdk-in-package-json-deps │ us-east-2 │ nodejs24.x │ >=2.0.0    │ No.                │
+└─────────────────────────────────────────┴───────────┴────────────┴────────────┴────────────────────┘
 ```
 
 This script requires AWS Managed Policy [AWSLambda_ReadOnlyAccess][].

package/dist/utils/constants.js

@@ -0,0 +1,3 @@
+export const PACKAGE_JSON = "package.json";
+export const NODE_MODULES = "node_modules";
+export const AWS_SDK = "aws-sdk";

package/dist/utils/getLambdaFunctionContents.js

@@ -1,5 +1,6 @@
 import StreamZip from "node-stream-zip";
-const PACKAGE_JSON_FILENAME = "package.json";
+import { AWS_SDK, NODE_MODULES, PACKAGE_JSON } from "./constants.js";
+import { join } from "node:path";
 /**
  * Extracts the contents of a Lambda Function zip file.
  * Returns string contents of package.json files, if available.
@@ -10,7 +11,9 @@ const PACKAGE_JSON_FILENAME = "package.json";
  */
 export const getLambdaFunctionContents = async (zipPath) => {
     const zip = new StreamZip.async({ file: zipPath });
-    const packageJsonFiles = [];
+    const codeMap = {};
+    const packageJsonMap = {};
+    const awsSdkPackageJsonMap = {};
     let zipEntries = {};
     try {
         zipEntries = await zip.entries();
@@ -20,51 +23,46 @@ export const getLambdaFunctionContents = async (zipPath) => {
         // ToDo: add warning when logging is supported in future.
     }
     for (const zipEntry of Object.values(zipEntries)) {
-        // Skip 'node_modules' directory, as it's not the customer source code.
-        if (zipEntry.name.includes("node_modules/"))
+        // Skip 'node_modules' directory, except for aws-sdk package.json file.
+        if (zipEntry.name.includes(`${NODE_MODULES}/`)) {
+            if (zipEntry.name.endsWith(join(NODE_MODULES, AWS_SDK, PACKAGE_JSON)) && zipEntry.isFile) {
+                const packageJsonContent = await zip.entryData(zipEntry.name);
+                awsSdkPackageJsonMap[zipEntry.name] = packageJsonContent.toString();
+            }
             continue;
-        // Skip anything which is not 'package.json'
-        if (!zipEntry.name.endsWith(PACKAGE_JSON_FILENAME))
-            continue;
-        // Skip if 'package.json' is not a file
-        if (!zipEntry.isFile)
-            continue;
-        try {
-            const packageJsonContent = await zip.entryData(zipEntry.name);
-            packageJsonFiles.push({
-                path: zipEntry.name,
-                content: packageJsonContent.toString(),
-            });
-        }
-        catch {
-            // Continue without adding package.json file, if entry data can't be read.
-            // ToDo: add warning when logging is supported in future.
         }
-    }
-    if (packageJsonFiles.length !== 0) {
-        await zip.close();
-        return { packageJsonFiles };
-    }
-    for (const path of ["index.js", "index.mjs", "index.cjs"]) {
-        if (!zipEntries[path])
+        // Skip if it is not a file
+        if (!zipEntry.isFile)
             continue;
-        if (!zipEntries[path].isFile)
+        // Populate 'package.json' files.
+        if (zipEntry.name.endsWith(PACKAGE_JSON)) {
+            try {
+                const packageJsonContent = await zip.entryData(zipEntry.name);
+                packageJsonMap[zipEntry.name] = packageJsonContent.toString();
+            }
+            catch {
+                // Continue without adding package.json file, if entry data can't be read.
+                // ToDo: add warning when logging is supported in future.
+            }
             continue;
-        try {
-            const bundleContent = await zip.entryData(path);
-            await zip.close();
-            return {
-                bundleFile: {
-                    path,
-                    content: bundleContent.toString(),
-                },
-            };
         }
-        catch {
-            // Continue processing next index file, if entry data can't be read.
-            // ToDo: add warning when logging is supported in future.
+        // Populate JavaScript/TypeScript files.
+        if (zipEntry.name.match(/\.(js|ts|mjs|cjs)$/)) {
+            try {
+                const codeContent = await zip.entryData(zipEntry.name);
+                codeMap[zipEntry.name] = codeContent.toString();
+            }
+            catch {
+                // Continue without adding code, if entry data can't be read.
+                // ToDo: add warning when logging is supported in future.
+            }
+            continue;
         }
     }
     await zip.close();
-    return {};
+    return {
+        codeMap,
+        ...(Object.keys(packageJsonMap).length > 0 && { packageJsonMap }),
+        ...(Object.keys(awsSdkPackageJsonMap).length > 0 && { awsSdkPackageJsonMap }),
+    };
 };

package/dist/utils/getLambdaFunctionScanOutput.js

@@ -1,10 +1,13 @@
-import { satisfies } from "compare-versions";
+import { satisfies, validate } from "compare-versions";
+import { AWS_SDK, NODE_MODULES, PACKAGE_JSON } from "./constants.js";
 import { downloadFile } from "./downloadFile.js";
 import { getLambdaFunctionContents, } from "./getLambdaFunctionContents.js";
+import { getPossibleHandlerFiles } from "./getPossibleHandlerFiles.js";
 import { hasSdkV2InBundle } from "./hasSdkV2InBundle.js";
+import { hasSdkV2InFile } from "./hasSdkV2InFile.js";
 import { rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 /**
  * Scans a Lambda function to detect AWS SDK for JavaScript v2 usage.
  *
@@ -44,16 +47,65 @@ export const getLambdaFunctionScanOutput = async (client, { functionName, region
     finally {
         await rm(zipPath, { force: true });
     }
-    const { packageJsonFiles, bundleFile } = lambdaFunctionContents;
-    // Search for "aws-sdk" in package.json dependencies if present.
-    if (packageJsonFiles && packageJsonFiles.length > 0) {
-        for (const { path: packageJsonPath, content: packageJsonContent } of packageJsonFiles) {
+    const { packageJsonMap, awsSdkPackageJsonMap, codeMap } = lambdaFunctionContents;
+    // Process handler as bundle file first.
+    const possibleHandlerFiles = getPossibleHandlerFiles(response.Configuration?.Handler ?? "index.handler");
+    for (const handlerFile of possibleHandlerFiles) {
+        if (handlerFile in codeMap) {
+            if (hasSdkV2InBundle(codeMap[handlerFile], sdkVersionRange)) {
+                output.ContainsAwsSdkJsV2 = true;
+                output.AwsSdkJsV2Locations = [handlerFile];
+                return output;
+            }
+        }
+    }
+    const filesWithJsSdkV2 = [];
+    // Search for JS SDK v2 occurrence in source code
+    for (const [filePath, fileContent] of Object.entries(codeMap)) {
+        try {
+            if (hasSdkV2InFile(filePath, fileContent)) {
+                filesWithJsSdkV2.push(filePath);
+            }
+        }
+        catch {
+            // Skip files that fail to parse
+        }
+    }
+    // JS SDK v2 not found in source code.
+    if (filesWithJsSdkV2.length === 0) {
+        output.ContainsAwsSdkJsV2 = false;
+        return output;
+    }
+    // Search for JS SDK v2 version from package.json
+    if (packageJsonMap && Object.keys(packageJsonMap).length > 0) {
+        for (const [packageJsonPath, packageJsonContent] of Object.entries(packageJsonMap)) {
             try {
                 const packageJson = JSON.parse(packageJsonContent);
                 const dependencies = packageJson.dependencies || {};
-                if ("aws-sdk" in dependencies) {
+                if (AWS_SDK in dependencies) {
+                    const awsSdkVersionInPackageJson = dependencies[AWS_SDK];
+                    const awsSdkPackageJsonPathInNodeModules = join(NODE_MODULES, AWS_SDK, PACKAGE_JSON);
+                    // Get aws-sdk package.json from nested node_modules or root node_modules.
+                    const awsSdkPackageJson = awsSdkPackageJsonMap
+                        ? (awsSdkPackageJsonMap[join(dirname(packageJsonPath), awsSdkPackageJsonPathInNodeModules)] ?? awsSdkPackageJsonMap[awsSdkPackageJsonPathInNodeModules])
+                        : undefined;
+                    let awsSdkVersionInNodeModules;
                     try {
-                        if (!satisfies(dependencies["aws-sdk"], sdkVersionRange)) {
+                        if (awsSdkPackageJson) {
+                            awsSdkVersionInNodeModules = JSON.parse(awsSdkPackageJson).version;
+                        }
+                    }
+                    catch {
+                        // Skip if JSON can't be parsed.
+                        // ToDo: add warning when logging is supported in future.
+                    }
+                    const sdkVersionToCheck = validate(awsSdkVersionInPackageJson) || awsSdkPackageJson === undefined
+                        ? // Use version in package.json dependencies, if fixed version is defined or aws-sdk package.json is not available.
+                            awsSdkVersionInPackageJson
+                        : // Use version from aws-sdk package.json, if defined
+                            (awsSdkVersionInNodeModules ?? awsSdkVersionInPackageJson);
+                    try {
+                        if (!satisfies(sdkVersionToCheck, sdkVersionRange)) {
                             continue;
                         }
                     }
@@ -64,7 +116,7 @@ export const getLambdaFunctionScanOutput = async (client, { functionName, region
                         return output;
                     }
                     output.ContainsAwsSdkJsV2 = true;
-                    output.AwsSdkJsV2Location = `Defined in dependencies of '${packageJsonPath}'`;
+                    output.AwsSdkJsV2Locations = filesWithJsSdkV2;
                     return output;
                 }
             }
@@ -76,23 +128,7 @@ export const getLambdaFunctionScanOutput = async (client, { functionName, region
             }
         }
     }
-    // Check for code of "aws-sdk" in bundle, if not found in package.json dependencies.
-    if (bundleFile) {
-        try {
-            if (hasSdkV2InBundle(bundleFile.content, sdkVersionRange)) {
-                output.ContainsAwsSdkJsV2 = true;
-                output.AwsSdkJsV2Location = `Bundled in '${bundleFile.path}'`;
-                return output;
-            }
-        }
-        catch (error) {
-            const errorPrefix = `Error reading bundle '${bundleFile.path}' for aws-sdk@${sdkVersionRange}`;
-            output.AwsSdkJsV2Error =
-                error instanceof Error ? `${errorPrefix}: ${error.message}` : errorPrefix;
-            return output;
-        }
-    }
-    // "aws-sdk" dependency/code not found.
+    // JS SDK v2 dependency/code not found.
     output.ContainsAwsSdkJsV2 = false;
     return output;
 };

package/dist/utils/getPossibleHandlerFiles.js

@@ -0,0 +1,9 @@
+/**
+ * Returns possible file paths for a Lambda handler.
+ * @param handlerPath - Lambda handler path (e.g., "index.handler").
+ * @returns Array of possible file paths with js, mjs, cjs, ts extensions.
+ */
+export const getPossibleHandlerFiles = (handlerPath) => {
+    const [handlerFile] = handlerPath.split(".");
+    return [`${handlerFile}.js`, `${handlerFile}.mjs`, `${handlerFile}.cjs`, `${handlerFile}.ts`];
+};

package/dist/utils/hasSdkV2InFile.js

@@ -0,0 +1,45 @@
+import { parseSync } from "oxc-parser";
+const isAwsSdkV2 = (path) => path === "aws-sdk" || path.startsWith("aws-sdk/");
+/**
+ * Recursively searches AST for JS SDK v2 require/import patterns.
+ * @param node - AST node to search.
+ * @returns true if JS SDK v2 require/import pattern is found.
+ */
+const hasAwsSdkV2InAst = (node) => {
+    if (!node || typeof node !== "object")
+        return false;
+    const n = node;
+    // Search for aws-sdk in require
+    if (n.type === "CallExpression" &&
+        n.callee?.name === "require" &&
+        isAwsSdkV2(n.arguments?.[0]?.value)) {
+        return true;
+    }
+    // Search for aws-sdk in import equals
+    if (n.type === "TSImportEqualsDeclaration" &&
+        n.moduleReference?.type === "TSExternalModuleReference" &&
+        isAwsSdkV2(n.moduleReference?.expression?.value)) {
+        return true;
+    }
+    // Search for aws-sdk in dynamic import
+    if (n.type === "ImportExpression" && isAwsSdkV2(n.source?.value ?? "")) {
+        return true;
+    }
+    return Object.values(n).some((child) => Array.isArray(child) ? child.some(hasAwsSdkV2InAst) : hasAwsSdkV2InAst(child));
+};
+/**
+ * Checks if a file contains AWS SDK for JavaScript v2 imports or requires.
+ * @param filePath - Path to the file (used for parser configuration).
+ * @param fileContent - Content of the file to analyze.
+ * @returns true if the file contains AWS SDK v2 usage.
+ */
+export const hasSdkV2InFile = (filePath, fileContent) => {
+    const { module, program } = parseSync(filePath, fileContent);
+    for (const { moduleRequest } of module.staticImports) {
+        if (isAwsSdkV2(moduleRequest.value))
+            return true;
+    }
+    if (hasAwsSdkV2InAst(program))
+        return true;
+    return false;
+};

package/dist/utils/printLambdaCommandOutput.js

@@ -25,8 +25,8 @@ export const printLambdaCommandOutput = (output, outputType) => {
         if (scanOutput.AwsSdkJsV2Error !== undefined) {
             notes += ` ${scanOutput.AwsSdkJsV2Error}`;
         }
-        if (scanOutput.AwsSdkJsV2Location !== undefined) {
-            notes += ` ${scanOutput.AwsSdkJsV2Location}`;
+        if (scanOutput.AwsSdkJsV2Locations !== undefined) {
+            notes += ` Found in:\n${scanOutput.AwsSdkJsV2Locations.map((location) => `- ${location}`).join("\n")}`;
         }
         table.push([
             scanOutput.FunctionName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/find-v2",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "CLI to find resources which call AWS using JavaScript SDK v2",
   "main": "dist/cli.js",
   "types": "dist/cli.d.ts",
@@ -11,6 +11,7 @@
     "commander": "^14.0.2",
     "compare-versions": "^6.1.1",
     "node-stream-zip": "^1.15.0",
+    "oxc-parser": "^0.107.0",
     "p-limit": "^7.2.0"
   },
   "devDependencies": {