@digitraffic/common 2026.4.20-1 → 2026.4.20-2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -11,4 +11,9 @@ export declare class DigitrafficCanaryRole extends Role {
|
|
|
11
11
|
* A UrlCanary needs these permissions to e.g. access a private API Gateway endpoint in a VPC.
|
|
12
12
|
*/
|
|
13
13
|
withVpcAccess(): this;
|
|
14
|
+
/**
|
|
15
|
+
* Provides permissions to read API keys from API Gateway.
|
|
16
|
+
* Required for URL canaries that validate API-key-protected endpoints.
|
|
17
|
+
*/
|
|
18
|
+
withApiGatewayAccess(): this;
|
|
14
19
|
}
|
|
@@ -28,10 +28,6 @@ export class DigitrafficCanaryRole extends Role {
|
|
|
28
28
|
});
|
|
29
29
|
this.addToPolicy(new PolicyStatement(BASE_POLICY_STATEMENT_PROPS));
|
|
30
30
|
this.addToPolicy(new PolicyStatement(CLOUDWATCH_STATEMENT_PROPS));
|
|
31
|
-
this.addToPolicy(new PolicyStatement({
|
|
32
|
-
actions: ["apigateway:GET"],
|
|
33
|
-
resources: ["arn:aws:apigateway:*::/apikeys/*"],
|
|
34
|
-
}));
|
|
35
31
|
}
|
|
36
32
|
/**
|
|
37
33
|
* Provides permissions to access resources within a VPC.
|
|
@@ -51,5 +47,16 @@ export class DigitrafficCanaryRole extends Role {
|
|
|
51
47
|
this.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaVPCAccessExecutionRole"));
|
|
52
48
|
return this;
|
|
53
49
|
}
|
|
50
|
+
/**
|
|
51
|
+
* Provides permissions to read API keys from API Gateway.
|
|
52
|
+
* Required for URL canaries that validate API-key-protected endpoints.
|
|
53
|
+
*/
|
|
54
|
+
withApiGatewayAccess() {
|
|
55
|
+
this.addToPolicy(new PolicyStatement({
|
|
56
|
+
actions: ["apigateway:GET"],
|
|
57
|
+
resources: ["arn:aws:apigateway:*::/apikeys/*"],
|
|
58
|
+
}));
|
|
59
|
+
return this;
|
|
60
|
+
}
|
|
54
61
|
}
|
|
55
62
|
//# sourceMappingURL=canary-role.js.map
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import { CfnCanary } from "aws-cdk-lib/aws-synthetics";
|
|
2
2
|
import { DigitrafficCanary } from "./canary.js";
|
|
3
3
|
import { ENV_API_KEY, ENV_HOSTNAME, ENV_SECRET } from "./canary-keys.js";
|
|
4
|
+
import { DigitrafficCanaryRole } from "./canary-role.js";
|
|
4
5
|
export class UrlCanary extends DigitrafficCanary {
|
|
5
6
|
constructor(stack, role, params, secret) {
|
|
6
7
|
const canaryName = `${params.name}-url`;
|
|
@@ -32,6 +33,9 @@ export class UrlCanary extends DigitrafficCanary {
|
|
|
32
33
|
}
|
|
33
34
|
}
|
|
34
35
|
static create(stack, role, publicApi, params, secret) {
|
|
36
|
+
if (role instanceof DigitrafficCanaryRole) {
|
|
37
|
+
role.withApiGatewayAccess();
|
|
38
|
+
}
|
|
35
39
|
return new UrlCanary(stack, role, {
|
|
36
40
|
handler: `${params.name ?? undefined}.handler`,
|
|
37
41
|
hostname: publicApi.hostname(),
|