@aws-sdk/find-v2 0.6.1 → 0.7.1

package/README.md

@@ -33,17 +33,19 @@ Run `lambda` command to scan Lambda Node.js Functions for JavaScript SDK v2.
 
 ```console
 $ npx @aws-sdk/find-v2 lambda --yes --output table
-┌─────────────────────────────────────────┬───────────┬────────────┬────────────┬────────────────────────────────────────────────┐
-│ FunctionName                            │ Region    │ Runtime    │ SdkVersion │ ContainsAwsSdkJsV2                             │
-├─────────────────────────────────────────┼───────────┼────────────┼────────────┼────────────────────────────────────────────────┤
-│ fn-without-aws-sdk-in-bundle            │ us-east-2 │ nodejs24.x │ >=2.0.0    │ No.                                            │
-├─────────────────────────────────────────┼───────────┼────────────┼────────────┼────────────────────────────────────────────────┤
-│ fn-with-aws-sdk-in-bundle               │ us-east-2 │ nodejs24.x │ >=2.0.0    │ Yes. Bundled in 'index.js'                     │
-├─────────────────────────────────────────┼───────────┼────────────┼────────────┼────────────────────────────────────────────────┤
-│ fn-with-aws-sdk-in-package-json-deps    │ us-east-2 │ nodejs24.x │ >=2.0.0    │ Yes. Defined in dependencies of 'package.json' │
-├─────────────────────────────────────────┼───────────┼────────────┼────────────┼────────────────────────────────────────────────┤
-│ fn-without-aws-sdk-in-package-json-deps │ us-east-2 │ nodejs24.x │ >=2.0.0    │ No.                                            │
-└─────────────────────────────────────────┴───────────┴────────────┴────────────┴────────────────────────────────────────────────┘
+┌─────────────────────────────────────────┬───────────┬────────────┬────────────┬────────────────────┐
+│ FunctionName                            │ Region    │ Runtime    │ SdkVersion │ ContainsAwsSdkJsV2 │
+├─────────────────────────────────────────┼───────────┼────────────┼────────────┼────────────────────┤
+│ fn-without-aws-sdk-in-bundle            │ us-east-2 │ nodejs24.x │ >=2.0.0    │ No.                │
+├─────────────────────────────────────────┼───────────┼────────────┼────────────┼────────────────────┤
+│ fn-with-aws-sdk-in-bundle               │ us-east-2 │ nodejs24.x │ >=2.0.0    │ Yes. Found in:     │
+│                                         │           │            │            │ - index.js         │
+├─────────────────────────────────────────┼───────────┼────────────┼────────────┼────────────────────┤
+│ fn-with-aws-sdk-in-package-json-deps    │ us-east-2 │ nodejs24.x │ >=2.0.0    │ Yes. Found in:     │
+│                                         │           │            │            │ - index.mjs        │
+├─────────────────────────────────────────┼───────────┼────────────┼────────────┼────────────────────┤
+│ fn-without-aws-sdk-in-package-json-deps │ us-east-2 │ nodejs24.x │ >=2.0.0    │ No.                │
+└─────────────────────────────────────────┴───────────┴────────────┴────────────┴────────────────────┘
 ```
 
 This script requires AWS Managed Policy [AWSLambda_ReadOnlyAccess][].

package/dist/utils/getCodePathToSdkVersionMap.js

@@ -0,0 +1,44 @@
+import { dirname, join } from "node:path";
+import { AWS_SDK, NODE_MODULES, PACKAGE_JSON } from "./constants.js";
+const AWS_SDK_PACKAGE_JSON = join(NODE_MODULES, AWS_SDK, PACKAGE_JSON);
+const safeParse = (json) => {
+    try {
+        return JSON.parse(json);
+    }
+    catch {
+        // ToDo: add warning when logging is supported in future.
+        return {};
+    }
+};
+/**
+ * Maps code file paths to their JS SDK v2 versions.
+ *
+ * Searches up the directory tree from each code path to find package.json,
+ * then resolves SDK version from node_modules/aws-sdk or dependencies.
+ *
+ * @param codePaths - Code file paths to map.
+ * @param packageJsonMap - Map of package.json paths to contents.
+ * @param awsSdkPackageJsonMap - Map of aws-sdk package.json paths to contents.
+ * @returns Map of code paths to SDK versions (undefined if not found).
+ */
+export const getCodePathToSdkVersionMap = (codePaths, packageJsonMap = new Map(), awsSdkPackageJsonMap = new Map()) => {
+    const dirToSdkVersionMap = new Map();
+    const getSdkVersion = (dir) => {
+        if (dirToSdkVersionMap.has(dir))
+            return dirToSdkVersionMap.get(dir);
+        let version;
+        // Assign version from node_modules aws-sdk package.json, if available.
+        const awsSdkPackageJson = awsSdkPackageJsonMap.get(join(dir, AWS_SDK_PACKAGE_JSON)) ??
+            awsSdkPackageJsonMap.get(AWS_SDK_PACKAGE_JSON);
+        version ??= awsSdkPackageJson && safeParse(awsSdkPackageJson).version;
+        // Assign version from package.json dependencies, if not populated yet.
+        const pkgJson = packageJsonMap.get(join(dir, PACKAGE_JSON));
+        version ??= pkgJson && safeParse(pkgJson).dependencies?.[AWS_SDK];
+        // Assign undefined if it's rootDir, else call getSdkVersion on parent dir, if not populated yet.
+        const parentDir = dirname(dir);
+        version ??= parentDir !== dir ? getSdkVersion(parentDir) : undefined;
+        dirToSdkVersionMap.set(dir, version);
+        return version;
+    };
+    return new Map(codePaths.map((codePath) => [codePath, getSdkVersion(dirname(codePath))]));
+};

package/dist/utils/getLambdaFunctionContents.js

@@ -3,16 +3,20 @@ import { AWS_SDK, NODE_MODULES, PACKAGE_JSON } from "./constants.js";
 import { join } from "node:path";
 /**
  * Extracts the contents of a Lambda Function zip file.
- * Returns string contents of package.json files, if available.
- * Otherwise, returns the contents of bundle file.
+ *
+ * Parses the zip and returns:
+ * - JS/TS source files (excluding node_modules)
+ * - package.json files (excluding node_modules)
+ * - aws-sdk package.json from node_modules (for version detection)
  *
  * @param zipPath - The path to the zip file of Lambda Function.
- * @returns Promise<LambdaFunctionContents> - Resolves to an object containing the extracted contents.
+ * @returns Extracted contents categorized by file type.
  */
 export const getLambdaFunctionContents = async (zipPath) => {
     const zip = new StreamZip.async({ file: zipPath });
-    const packageJsonFiles = [];
-    const awsSdkPackageJsonMap = {};
+    const codeMap = new Map();
+    const packageJsonMap = new Map();
+    const awsSdkPackageJsonMap = new Map();
     let zipEntries = {};
     try {
         zipEntries = await zip.entries();
@@ -26,55 +30,42 @@ export const getLambdaFunctionContents = async (zipPath) => {
         if (zipEntry.name.includes(`${NODE_MODULES}/`)) {
             if (zipEntry.name.endsWith(join(NODE_MODULES, AWS_SDK, PACKAGE_JSON)) && zipEntry.isFile) {
                 const packageJsonContent = await zip.entryData(zipEntry.name);
-                awsSdkPackageJsonMap[zipEntry.name] = packageJsonContent.toString();
+                awsSdkPackageJsonMap.set(zipEntry.name, packageJsonContent.toString());
             }
             continue;
         }
-        // Skip anything which is not 'package.json'
-        if (!zipEntry.name.endsWith(PACKAGE_JSON))
-            continue;
-        // Skip if 'package.json' is not a file
+        // Skip if it is not a file
         if (!zipEntry.isFile)
             continue;
-        try {
-            const packageJsonContent = await zip.entryData(zipEntry.name);
-            packageJsonFiles.push({
-                path: zipEntry.name,
-                content: packageJsonContent.toString(),
-            });
-        }
-        catch {
-            // Continue without adding package.json file, if entry data can't be read.
-            // ToDo: add warning when logging is supported in future.
-        }
-    }
-    if (packageJsonFiles.length !== 0) {
-        await zip.close();
-        return {
-            packageJsonFiles,
-            ...(Object.keys(awsSdkPackageJsonMap).length > 0 && { awsSdkPackageJsonMap }),
-        };
-    }
-    for (const path of ["index.js", "index.mjs", "index.cjs"]) {
-        if (!zipEntries[path])
-            continue;
-        if (!zipEntries[path].isFile)
+        // Populate 'package.json' files.
+        if (zipEntry.name.endsWith(PACKAGE_JSON)) {
+            try {
+                const packageJsonContent = await zip.entryData(zipEntry.name);
+                packageJsonMap.set(zipEntry.name, packageJsonContent.toString());
+            }
+            catch {
+                // Continue without adding package.json file, if entry data can't be read.
+                // ToDo: add warning when logging is supported in future.
+            }
             continue;
-        try {
-            const bundleContent = await zip.entryData(path);
-            await zip.close();
-            return {
-                bundleFile: {
-                    path,
-                    content: bundleContent.toString(),
-                },
-            };
         }
-        catch {
-            // Continue processing next index file, if entry data can't be read.
-            // ToDo: add warning when logging is supported in future.
+        // Populate JavaScript/TypeScript files.
+        if (zipEntry.name.match(/\.(js|ts|mjs|cjs)$/)) {
+            try {
+                const codeContent = await zip.entryData(zipEntry.name);
+                codeMap.set(zipEntry.name, codeContent.toString());
+            }
+            catch {
+                // Continue without adding code, if entry data can't be read.
+                // ToDo: add warning when logging is supported in future.
+            }
+            continue;
         }
     }
     await zip.close();
-    return {};
+    return {
+        codeMap,
+        ...(packageJsonMap.size > 0 && { packageJsonMap }),
+        ...(awsSdkPackageJsonMap.size > 0 && { awsSdkPackageJsonMap }),
+    };
 };

package/dist/utils/getLambdaFunctionScanOutput.js

@@ -1,21 +1,27 @@
 import { satisfies, validate } from "compare-versions";
 import { downloadFile } from "./downloadFile.js";
 import { getLambdaFunctionContents, } from "./getLambdaFunctionContents.js";
+import { getPossibleHandlerFiles } from "./getPossibleHandlerFiles.js";
 import { hasSdkV2InBundle } from "./hasSdkV2InBundle.js";
+import { hasSdkV2InFile } from "./hasSdkV2InFile.js";
 import { rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
-import { AWS_SDK, NODE_MODULES, PACKAGE_JSON } from "./constants.js";
+import { join } from "node:path";
+import { getCodePathToSdkVersionMap } from "./getCodePathToSdkVersionMap.js";
 /**
  * Scans a Lambda function to detect AWS SDK for JavaScript v2 usage.
  *
- * Downloads the function code, extracts it, and checks for v2 SDK in:
- * 1. package.json dependencies
- * 2. Bundled index file
+ * Downloads the function code, extracts it, and checks for JS SDK v2 signature in handled file if it's a bundle.
+ * If not found, it checks for source code files has require/imports JS SDK v2. It also checks dependencies in
+ * package.json for version validation.
  *
  * @param client - AWS Lambda client instance
  * @param options - Scan configuration options
- * @returns Scan results including SDK v2 detection status and location
+ * @param options.functionName - The name of the Lambda function
+ * @param options.region - AWS region the Lambda function is deployed to
+ * @param options.runtime - Lambda Function's Node.js runtime
+ * @param options.sdkVersionRange - Semver range string to check for AWS SDK for JavaScript v2
+ * @returns Scan results including SDK v2 detection status and locations
  */
 export const getLambdaFunctionScanOutput = async (client, { functionName, region, runtime, sdkVersionRange }) => {
     const output = {
@@ -45,76 +51,57 @@ export const getLambdaFunctionScanOutput = async (client, { functionName, region
     finally {
         await rm(zipPath, { force: true });
     }
-    const { packageJsonFiles, awsSdkPackageJsonMap, bundleFile } = lambdaFunctionContents;
-    // Search for JS SDK v2 in package.json dependencies if present.
-    if (packageJsonFiles && packageJsonFiles.length > 0) {
-        for (const { path: packageJsonPath, content: packageJsonContent } of packageJsonFiles) {
-            try {
-                const packageJson = JSON.parse(packageJsonContent);
-                const dependencies = packageJson.dependencies || {};
-                if (AWS_SDK in dependencies) {
-                    const awsSdkVersionInPackageJson = dependencies[AWS_SDK];
-                    const awsSdkPackageJsonPathInNodeModules = join(NODE_MODULES, AWS_SDK, PACKAGE_JSON);
-                    // Get aws-sdk package.json from nested node_modules or root node_modules.
-                    const awsSdkPackageJson = awsSdkPackageJsonMap
-                        ? (awsSdkPackageJsonMap[join(dirname(packageJsonPath), awsSdkPackageJsonPathInNodeModules)] ?? awsSdkPackageJsonMap[awsSdkPackageJsonPathInNodeModules])
-                        : undefined;
-                    let awsSdkVersionInNodeModules;
-                    try {
-                        if (awsSdkPackageJson) {
-                            awsSdkVersionInNodeModules = JSON.parse(awsSdkPackageJson).version;
-                        }
-                    }
-                    catch {
-                        // Skip if JSON can't be parsed.
-                        // ToDo: add warning when logging is supported in future.
-                    }
-                    const sdkVersionToCheck = validate(awsSdkVersionInPackageJson) || awsSdkPackageJson === undefined
-                        ? // Use version in package.json dependencies, if fixed version is defined or aws-sdk package.json is not available.
-                            awsSdkVersionInPackageJson
-                        : // Use version from aws-sdk package.json, if defined
-                            (awsSdkVersionInNodeModules ?? awsSdkVersionInPackageJson);
-                    try {
-                        if (!satisfies(sdkVersionToCheck, sdkVersionRange)) {
-                            continue;
-                        }
-                    }
-                    catch (error) {
-                        const errorPrefix = `Error checking version range '${sdkVersionRange}' for aws-sdk@${dependencies["aws-sdk"]} in '${packageJsonPath}'`;
-                        output.AwsSdkJsV2Error =
-                            error instanceof Error ? `${errorPrefix}: ${error.message}` : errorPrefix;
-                        return output;
-                    }
-                    output.ContainsAwsSdkJsV2 = true;
-                    output.AwsSdkJsV2Location = `Defined in dependencies of '${packageJsonPath}'`;
-                    return output;
-                }
-            }
-            catch (error) {
-                const errorPrefix = `Error parsing '${packageJsonPath}'`;
-                output.AwsSdkJsV2Error =
-                    error instanceof Error ? `${errorPrefix}: ${error.message}` : errorPrefix;
+    const { packageJsonMap, awsSdkPackageJsonMap, codeMap } = lambdaFunctionContents;
+    // Process handler as bundle file first.
+    const possibleHandlerFiles = getPossibleHandlerFiles(response.Configuration?.Handler ?? "index.handler");
+    for (const handlerFile of possibleHandlerFiles) {
+        const handlerContent = codeMap.get(handlerFile);
+        if (handlerContent !== undefined) {
+            if (hasSdkV2InBundle(handlerContent, sdkVersionRange)) {
+                output.ContainsAwsSdkJsV2 = true;
+                output.AwsSdkJsV2Locations = [handlerFile];
                 return output;
             }
         }
     }
-    // Check for signature of JS SDK v2 in bundle, if not found in package.json dependencies.
-    if (bundleFile) {
+    const filesWithJsSdkV2 = [];
+    // Search for JS SDK v2 occurrence in source code
+    for (const [filePath, fileContent] of codeMap) {
         try {
-            if (hasSdkV2InBundle(bundleFile.content, sdkVersionRange)) {
-                output.ContainsAwsSdkJsV2 = true;
-                output.AwsSdkJsV2Location = `Bundled in '${bundleFile.path}'`;
-                return output;
+            if (hasSdkV2InFile(filePath, fileContent)) {
+                filesWithJsSdkV2.push(filePath);
             }
         }
-        catch (error) {
-            const errorPrefix = `Error reading bundle '${bundleFile.path}' for aws-sdk@${sdkVersionRange}`;
-            output.AwsSdkJsV2Error =
-                error instanceof Error ? `${errorPrefix}: ${error.message}` : errorPrefix;
-            return output;
+        catch {
+            // Skip files that fail to parse
+            // ToDo: add warning when logging is supported in future.
+        }
+    }
+    // JS SDK v2 not found in source code.
+    if (filesWithJsSdkV2.length === 0) {
+        output.ContainsAwsSdkJsV2 = false;
+        return output;
+    }
+    const codePathToSdkVersionMap = getCodePathToSdkVersionMap(filesWithJsSdkV2, packageJsonMap, awsSdkPackageJsonMap);
+    const jsSdkV2FilesInSdkVersionRange = [];
+    for (const [codePath, version] of codePathToSdkVersionMap) {
+        if (version && validate(version)) {
+            try {
+                if (satisfies(version, sdkVersionRange)) {
+                    jsSdkV2FilesInSdkVersionRange.push(codePath);
+                }
+            }
+            catch {
+                // Ignore if satisfies throws error
+                // ToDo: add warning when logging is supported in future.
+            }
         }
     }
-    // JS SDK v2 dependency/code not found.
+    if (jsSdkV2FilesInSdkVersionRange.length > 0) {
+        output.ContainsAwsSdkJsV2 = true;
+        output.AwsSdkJsV2Locations = jsSdkV2FilesInSdkVersionRange;
+        return output;
+    }
     output.ContainsAwsSdkJsV2 = false;
     return output;
 };

package/dist/utils/getPossibleHandlerFiles.js

@@ -0,0 +1,9 @@
+/**
+ * Returns possible file paths for a Lambda handler.
+ * @param handlerPath - Lambda handler path (e.g., "index.handler").
+ * @returns Array of possible file paths with js, mjs, cjs, ts extensions.
+ */
+export const getPossibleHandlerFiles = (handlerPath) => {
+    const [handlerFile] = handlerPath.split(".");
+    return [`${handlerFile}.js`, `${handlerFile}.mjs`, `${handlerFile}.cjs`, `${handlerFile}.ts`];
+};

package/dist/utils/hasSdkV2InFile.js

@@ -0,0 +1,45 @@
+import { parseSync } from "oxc-parser";
+const isAwsSdkV2 = (path) => path === "aws-sdk" || path.startsWith("aws-sdk/");
+/**
+ * Recursively searches AST for JS SDK v2 require/import patterns.
+ * @param node - AST node to search.
+ * @returns true if JS SDK v2 require/import pattern is found.
+ */
+const hasAwsSdkV2InAst = (node) => {
+    if (!node || typeof node !== "object")
+        return false;
+    const n = node;
+    // Search for aws-sdk in require
+    if (n.type === "CallExpression" &&
+        n.callee?.name === "require" &&
+        isAwsSdkV2(n.arguments?.[0]?.value)) {
+        return true;
+    }
+    // Search for aws-sdk in import equals
+    if (n.type === "TSImportEqualsDeclaration" &&
+        n.moduleReference?.type === "TSExternalModuleReference" &&
+        isAwsSdkV2(n.moduleReference?.expression?.value)) {
+        return true;
+    }
+    // Search for aws-sdk in dynamic import
+    if (n.type === "ImportExpression" && isAwsSdkV2(n.source?.value ?? "")) {
+        return true;
+    }
+    return Object.values(n).some((child) => Array.isArray(child) ? child.some(hasAwsSdkV2InAst) : hasAwsSdkV2InAst(child));
+};
+/**
+ * Checks if a file contains AWS SDK for JavaScript v2 imports or requires.
+ * @param filePath - Path to the file (used for parser configuration).
+ * @param fileContent - Content of the file to analyze.
+ * @returns true if the file contains AWS SDK v2 usage.
+ */
+export const hasSdkV2InFile = (filePath, fileContent) => {
+    const { module, program } = parseSync(filePath, fileContent);
+    for (const { moduleRequest } of module.staticImports) {
+        if (isAwsSdkV2(moduleRequest.value))
+            return true;
+    }
+    if (hasAwsSdkV2InAst(program))
+        return true;
+    return false;
+};

package/dist/utils/printLambdaCommandOutput.js

@@ -25,8 +25,8 @@ export const printLambdaCommandOutput = (output, outputType) => {
         if (scanOutput.AwsSdkJsV2Error !== undefined) {
             notes += ` ${scanOutput.AwsSdkJsV2Error}`;
         }
-        if (scanOutput.AwsSdkJsV2Location !== undefined) {
-            notes += ` ${scanOutput.AwsSdkJsV2Location}`;
+        if (scanOutput.AwsSdkJsV2Locations !== undefined) {
+            notes += ` Found in:\n${scanOutput.AwsSdkJsV2Locations.map((location) => `- ${location}`).join("\n")}`;
         }
         table.push([
             scanOutput.FunctionName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/find-v2",
-  "version": "0.6.1",
+  "version": "0.7.1",
   "description": "CLI to find resources which call AWS using JavaScript SDK v2",
   "main": "dist/cli.js",
   "types": "dist/cli.d.ts",
@@ -11,6 +11,7 @@
     "commander": "^14.0.2",
     "compare-versions": "^6.1.1",
     "node-stream-zip": "^1.15.0",
+    "oxc-parser": "^0.107.0",
     "p-limit": "^7.2.0"
   },
   "devDependencies": {