@aws/nx-plugin 1.0.0-rc.53 → 1.0.0-rc.54

package/migrations.json

@@ -21,6 +21,11 @@
       "version": "1.0.0-rc.52",
       "description": "Count the EC2MetaDataSSRF_QUERYARGUMENTS WAF rule on the UserIdentity Web ACL so sign-in from a local dev server is not blocked",
       "implementation": "./src/migrations/latest/user-identity-waf-allow-localhost-callback/migration"
+    },
+    "latest-order-access-log-delivery-after-bucket-policy": {
+      "version": "1.0.0-rc.54",
+      "description": "Order the S3 server access log delivery source after the bucket policy to avoid a 409 from concurrent bucket configuration writes",
+      "implementation": "./src/migrations/latest/order-access-log-delivery-after-bucket-policy/migration"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.53",
+  "version": "1.0.0-rc.54",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",

package/src/migrations/latest/order-access-log-delivery-after-bucket-policy/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MigrationReturnObject, Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/order-access-log-delivery-after-bucket-policy/migration.js

@@ -0,0 +1,94 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { addDestructuredImport, applyGritQL, captureGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Order the S3 server access log delivery source after the bucket policy.
+ *
+ * S3 rejects concurrent configuration writes against the same bucket with a 409
+ * (OperationAborted). The generated StaticWebsite construct left the delivery
+ * source and the bucket policy unordered, so CloudFormation could submit both at
+ * once and fail the stack.
+ */ const STATIC_WEBSITE_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/static-website.ts`;
+const BUCKET_ARN_SUFFIX = '.bucketArn';
+/**
+ * The bucket whose policy the delivery source must be ordered after is the one
+ * the delivery source itself targets, so read it off `resourceArn` rather than
+ * assuming the generated parameter name. Returns undefined unless exactly one
+ * simple identifier is found, so a diverged helper is left alone.
+ */ const findDeliverySourceBucket = async (tree, filePath)=>{
+    const captured = await captureGritQL(tree, filePath, '`resourceArn: $bucket.bucketArn`');
+    if (!captured) return undefined;
+    const bucket = captured.slice(captured.indexOf(':') + 1).replace(BUCKET_ARN_SUFFIX, '').trim();
+    // Only a plain identifier can be cast and dereferenced safely in the
+    // statement this migration writes.
+    return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(bucket) ? bucket : undefined;
+};
+/**
+ * Confirm the bucket the delivery source targets is declared as a parameter of
+ * the enclosing helper, so the statement this migration writes references a
+ * variable that is actually in scope.
+ */ const isBucketDeclaredParameter = async (tree, filePath, bucket)=>await matchGritQL(tree, filePath, `\`private deliverAccessLogsToCloudWatch($params) { $_ }\` where {
+      $params <: contains \`${bucket}: $bucketType\`,
+      $bucketType <: or { \`IBucket\`, \`Bucket\` }
+    }`);
+// Inserts the bucket policy dependency between the delivery source and the
+// delivery destination, matching the shape generators produced prior to this
+// fix. Anchored on the destination declaration so the source's own (multi-line,
+// Lazy-valued) arguments don't need to be matched.
+const addDependencyPattern = (bucket)=>`\`const $dest: CfnDeliveryDestination = new CfnDeliveryDestination($destArgs)\` as $decl where {
+  $dest <: \`destination\`
+} => \`const bucketPolicy = (${bucket} as Bucket).policy;
+    if (bucketPolicy) {
+      source.node.addDependency(bucketPolicy);
+    }
+    $decl\``;
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(STATIC_WEBSITE_FILE)) {
+        // No vended StaticWebsite construct in this workspace - nothing to migrate.
+        return {
+            nextSteps
+        };
+    }
+    const contents = tree.read(STATIC_WEBSITE_FILE, 'utf-8') ?? '';
+    if (contents.includes('source.node.addDependency(bucketPolicy)')) {
+        // Already migrated.
+        return {
+            nextSteps
+        };
+    }
+    const divergedMessage = `${STATIC_WEBSITE_FILE}: deliverAccessLogsToCloudWatch has diverged from the generated shape - left untouched. Manually order the S3 server access log delivery source after the bucket policy of the bucket it targets (\`source.node.addDependency(bucketPolicy)\`), avoiding a 409 (OperationAborted) from concurrent bucket configuration writes.`;
+    // The rewrite is anchored on the delivery destination but references the
+    // `source` variable, so only apply it when the delivery source still has the
+    // generated shape.
+    const hasGeneratedSource = await matchGritQL(tree, STATIC_WEBSITE_FILE, '`const source: CfnDeliverySource = new CfnDeliverySource($_)`');
+    const bucket = hasGeneratedSource ? await findDeliverySourceBucket(tree, STATIC_WEBSITE_FILE) : undefined;
+    if (!bucket || !await isBucketDeclaredParameter(tree, STATIC_WEBSITE_FILE, bucket)) {
+        nextSteps.push(divergedMessage);
+        return {
+            nextSteps
+        };
+    }
+    const rewrote = await applyGritQL(tree, STATIC_WEBSITE_FILE, addDependencyPattern(bucket));
+    if (!rewrote) {
+        nextSteps.push(divergedMessage);
+        return {
+            nextSteps
+        };
+    }
+    // The inserted statement casts to the concrete Bucket to reach its policy,
+    // which the helper's own `IBucket` parameter type does not expose.
+    await addDestructuredImport(tree, STATIC_WEBSITE_FILE, [
+        'Bucket'
+    ], 'aws-cdk-lib/aws-s3');
+    nextSteps.push(`${STATIC_WEBSITE_FILE}: the S3 server access log delivery source is now created after the policy of the bucket it targets, avoiding a 409 (OperationAborted) from concurrent bucket configuration writes.`);
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/order-access-log-delivery-after-bucket-policy/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/order-access-log-delivery-after-bucket-policy/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  applyGritQL,\n  captureGritQL,\n  matchGritQL,\n} from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants';\n\n/**\n * Order the S3 server access log delivery source after the bucket policy.\n *\n * S3 rejects concurrent configuration writes against the same bucket with a 409\n * (OperationAborted). The generated StaticWebsite construct left the delivery\n * source and the bucket policy unordered, so CloudFormation could submit both at\n * once and fail the stack.\n */\n\nconst STATIC_WEBSITE_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/static-website.ts`;\n\nconst BUCKET_ARN_SUFFIX = '.bucketArn';\n\n/**\n * The bucket whose policy the delivery source must be ordered after is the one\n * the delivery source itself targets, so read it off `resourceArn` rather than\n * assuming the generated parameter name. Returns undefined unless exactly one\n * simple identifier is found, so a diverged helper is left alone.\n */\nconst findDeliverySourceBucket = async (\n  tree: Tree,\n  filePath: string,\n): Promise<string | undefined> => {\n  const captured = await captureGritQL(\n    tree,\n    filePath,\n    '`resourceArn: $bucket.bucketArn`',\n  );\n  if (!captured) return undefined;\n\n  const bucket = captured\n    .slice(captured.indexOf(':') + 1)\n    .replace(BUCKET_ARN_SUFFIX, '')\n    .trim();\n\n  // Only a plain identifier can be cast and dereferenced safely in the\n  // statement this migration writes.\n  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(bucket) ? bucket : undefined;\n};\n\n/**\n * Confirm the bucket the delivery source targets is declared as a parameter of\n * the enclosing helper, so the statement this migration writes references a\n * variable that is actually in scope.\n */\nconst isBucketDeclaredParameter = async (\n  tree: Tree,\n  filePath: string,\n  bucket: string,\n): Promise<boolean> =>\n  await matchGritQL(\n    tree,\n    filePath,\n    `\\`private deliverAccessLogsToCloudWatch($params) { $_ }\\` where {\n      $params <: contains \\`${bucket}: $bucketType\\`,\n      $bucketType <: or { \\`IBucket\\`, \\`Bucket\\` }\n    }`,\n  );\n\n// Inserts the bucket policy dependency between the delivery source and the\n// delivery destination, matching the shape generators produced prior to this\n// fix. Anchored on the destination declaration so the source's own (multi-line,\n// Lazy-valued) arguments don't need to be matched.\nconst addDependencyPattern = (bucket: string) =>\n  `\\`const $dest: CfnDeliveryDestination = new CfnDeliveryDestination($destArgs)\\` as $decl where {\n  $dest <: \\`destination\\`\n} => \\`const bucketPolicy = (${bucket} as Bucket).policy;\n    if (bucketPolicy) {\n      source.node.addDependency(bucketPolicy);\n    }\n    $decl\\``;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(STATIC_WEBSITE_FILE)) {\n    // No vended StaticWebsite construct in this workspace - nothing to migrate.\n    return { nextSteps };\n  }\n\n  const contents = tree.read(STATIC_WEBSITE_FILE, 'utf-8') ?? '';\n  if (contents.includes('source.node.addDependency(bucketPolicy)')) {\n    // Already migrated.\n    return { nextSteps };\n  }\n\n  const divergedMessage = `${STATIC_WEBSITE_FILE}: deliverAccessLogsToCloudWatch has diverged from the generated shape - left untouched. Manually order the S3 server access log delivery source after the bucket policy of the bucket it targets (\\`source.node.addDependency(bucketPolicy)\\`), avoiding a 409 (OperationAborted) from concurrent bucket configuration writes.`;\n\n  // The rewrite is anchored on the delivery destination but references the\n  // `source` variable, so only apply it when the delivery source still has the\n  // generated shape.\n  const hasGeneratedSource = await matchGritQL(\n    tree,\n    STATIC_WEBSITE_FILE,\n    '`const source: CfnDeliverySource = new CfnDeliverySource($_)`',\n  );\n\n  const bucket = hasGeneratedSource\n    ? await findDeliverySourceBucket(tree, STATIC_WEBSITE_FILE)\n    : undefined;\n\n  if (\n    !bucket ||\n    !(await isBucketDeclaredParameter(tree, STATIC_WEBSITE_FILE, bucket))\n  ) {\n    nextSteps.push(divergedMessage);\n    return { nextSteps };\n  }\n\n  const rewrote = await applyGritQL(\n    tree,\n    STATIC_WEBSITE_FILE,\n    addDependencyPattern(bucket),\n  );\n\n  if (!rewrote) {\n    nextSteps.push(divergedMessage);\n    return { nextSteps };\n  }\n\n  // The inserted statement casts to the concrete Bucket to reach its policy,\n  // which the helper's own `IBucket` parameter type does not expose.\n  await addDestructuredImport(\n    tree,\n    STATIC_WEBSITE_FILE,\n    ['Bucket'],\n    'aws-cdk-lib/aws-s3',\n  );\n\n  nextSteps.push(\n    `${STATIC_WEBSITE_FILE}: the S3 server access log delivery source is now created after the policy of the bucket it targets, avoiding a 409 (OperationAborted) from concurrent bucket configuration writes.`,\n  );\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["addDestructuredImport","applyGritQL","captureGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","STATIC_WEBSITE_FILE","BUCKET_ARN_SUFFIX","findDeliverySourceBucket","tree","filePath","captured","undefined","bucket","slice","indexOf","replace","trim","test","isBucketDeclaredParameter","addDependencyPattern","migration","nextSteps","exists","contents","read","includes","divergedMessage","hasGeneratedSource","push","rewrote"],"mappings":"AAAA;;;CAGC,GAED,SACEA,qBAAqB,EACrBC,WAAW,EACXC,aAAa,EACbC,WAAW,QACN,wBAAqB;AAC5B,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAA6C;AAEpD;;;;;;;CAOC,GAED,MAAMC,sBAAsB,GAAGF,aAAa,CAAC,EAAEC,sBAAsB,2BAA2B,CAAC;AAEjG,MAAME,oBAAoB;AAE1B;;;;;CAKC,GACD,MAAMC,2BAA2B,OAC/BC,MACAC;IAEA,MAAMC,WAAW,MAAMV,cACrBQ,MACAC,UACA;IAEF,IAAI,CAACC,UAAU,OAAOC;IAEtB,MAAMC,SAASF,SACZG,KAAK,CAACH,SAASI,OAAO,CAAC,OAAO,GAC9BC,OAAO,CAACT,mBAAmB,IAC3BU,IAAI;IAEP,qEAAqE;IACrE,mCAAmC;IACnC,OAAO,6BAA6BC,IAAI,CAACL,UAAUA,SAASD;AAC9D;AAEA;;;;CAIC,GACD,MAAMO,4BAA4B,OAChCV,MACAC,UACAG,SAEA,MAAMX,YACJO,MACAC,UACA,CAAC;4BACuB,EAAEG,OAAO;;KAEhC,CAAC;AAGN,2EAA2E;AAC3E,6EAA6E;AAC7E,gFAAgF;AAChF,mDAAmD;AACnD,MAAMO,uBAAuB,CAACP,SAC5B,CAAC;;6BAE0B,EAAEA,OAAO;;;;WAI3B,CAAC;AAEZ,eAAe,eAAeQ,UAC5BZ,IAAU;IAEV,MAAMa,YAAsB,EAAE;IAE9B,IAAI,CAACb,KAAKc,MAAM,CAACjB,sBAAsB;QACrC,4EAA4E;QAC5E,OAAO;YAAEgB;QAAU;IACrB;IAEA,MAAME,WAAWf,KAAKgB,IAAI,CAACnB,qBAAqB,YAAY;IAC5D,IAAIkB,SAASE,QAAQ,CAAC,4CAA4C;QAChE,oBAAoB;QACpB,OAAO;YAAEJ;QAAU;IACrB;IAEA,MAAMK,kBAAkB,GAAGrB,oBAAoB,8TAA8T,CAAC;IAE9W,yEAAyE;IACzE,6EAA6E;IAC7E,mBAAmB;IACnB,MAAMsB,qBAAqB,MAAM1B,YAC/BO,MACAH,qBACA;IAGF,MAAMO,SAASe,qBACX,MAAMpB,yBAAyBC,MAAMH,uBACrCM;IAEJ,IACE,CAACC,UACD,CAAE,MAAMM,0BAA0BV,MAAMH,qBAAqBO,SAC7D;QACAS,UAAUO,IAAI,CAACF;QACf,OAAO;YAAEL;QAAU;IACrB;IAEA,MAAMQ,UAAU,MAAM9B,YACpBS,MACAH,qBACAc,qBAAqBP;IAGvB,IAAI,CAACiB,SAAS;QACZR,UAAUO,IAAI,CAACF;QACf,OAAO;YAAEL;QAAU;IACrB;IAEA,2EAA2E;IAC3E,mEAAmE;IACnE,MAAMvB,sBACJU,MACAH,qBACA;QAAC;KAAS,EACV;IAGFgB,UAAUO,IAAI,CACZ,GAAGvB,oBAAoB,mLAAmL,CAAC;IAG7M,MAAMH,qBAAqBM;IAE3B,OAAO;QAAEa;IAAU;AACrB"}

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -1940,6 +1940,10 @@ export class StaticWebsite extends Construct {
         resourceArn: bucket.bucketArn,
       },
     );
+    const bucketPolicy = (bucket as Bucket).policy;
+    if (bucketPolicy) {
+      source.node.addDependency(bucketPolicy);
+    }
     const destination: CfnDeliveryDestination = new CfnDeliveryDestination(
       this,
       \`\${id}AccessLogsDestination\`,
@@ -3750,6 +3754,10 @@ export class StaticWebsite extends Construct {
         resourceArn: bucket.bucketArn,
       },
     );
+    const bucketPolicy = (bucket as Bucket).policy;
+    if (bucketPolicy) {
+      source.node.addDependency(bucketPolicy);
+    }
     const destination: CfnDeliveryDestination = new CfnDeliveryDestination(
       this,
       \`\${id}AccessLogsDestination\`,
@@ -5420,6 +5428,10 @@ export class StaticWebsite extends Construct {
         resourceArn: bucket.bucketArn,
       },
     );
+    const bucketPolicy = (bucket as Bucket).policy;
+    if (bucketPolicy) {
+      source.node.addDependency(bucketPolicy);
+    }
     const destination: CfnDeliveryDestination = new CfnDeliveryDestination(
       this,
       \`\${id}AccessLogsDestination\`,

package/src/utils/website-constructs/files/cdk/core/static-website.ts.template

@@ -324,6 +324,10 @@ export class StaticWebsite extends Construct {
         resourceArn: bucket.bucketArn,
       },
     );
+    const bucketPolicy = (bucket as Bucket).policy;
+    if (bucketPolicy) {
+      source.node.addDependency(bucketPolicy);
+    }
     const destination: CfnDeliveryDestination = new CfnDeliveryDestination(
       this,
       `${id}AccessLogsDestination`,