@exabugs/dynamodb-client 0.6.1 → 0.7.0

package/CHANGELOG.md

@@ -7,9 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.0] - 2024-12-28
+
+### Added
+
+- **Terraform**: KMS access policy for Parameter Store integration
+  - Lambda functions can now decrypt SecureString environment variables
+  - Added `kms:Decrypt` permission with SSM service condition
+  - Enables secure configuration management through Parameter Store
+
+### Changed
+
+- **CORS**: Expanded CORS configuration for comprehensive API support
+  - Added support for GET, PUT, DELETE, and OPTIONS methods
+  - Previously only supported POST method
+  - Enables full REST API functionality for react-admin integration
+
+### Improved
+
+- **Infrastructure**: Enhanced Lambda function permissions and dependencies
+  - Added proper dependency management for KMS policy
+  - Improved security with least-privilege access patterns
+
 ## [0.5.0] - 2024-12-23
 
 ### Added
+
 - 包括的なAPIリファレンスドキュメント (`docs/API.md`)
   - 3つの認証方式（IAM、Cognito、Token）の詳細な説明
   - すべてのクライアントAPIメソッドの完全な仕様
@@ -27,6 +50,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - 開発者・利用者向けのセキュリティベストプラクティス
 
 ### Changed
+
 - アーキテクチャリファクタリングによるコード構造の改善
   - 共通モジュールの抽出 (`src/shared/` ディレクトリ構造)
   - 大きな関数の分割（handler.ts ~520行 → 複数モジュール）
@@ -35,6 +59,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - 依存関係管理と循環依存の解決
 
 ### Improved
+
 - コードの可読性と保守性の向上
 - 単一責任原則に基づく関数分割（50行制限）
 - 3回以上繰り返されるコードの共通関数化
@@ -248,6 +273,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Migration Guide
 
 **Before (v0.1.x):**
+
 ```typescript
 const client = new DynamoClient(apiUrl);
 await client.connect();
@@ -262,6 +288,7 @@ const dataProvider = createDataProvider({
 ```
 
 **After (v0.2.0):**
+
 ```typescript
 const client = new DynamoClient(apiUrl);
 await client.connect();

package/dist/server/handler.cjs

@@ -1,5 +1,5 @@
-// @exabugs/dynamodb-client v0.6.1
-// Built: 2025-12-27T04:48:12.419Z
+// @exabugs/dynamodb-client v0.7.0
+// Built: 2025-12-28T09:57:36.074Z
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exabugs/dynamodb-client",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "DynamoDB Single-Table Client SDK with MongoDB-like API, Shadow Records, and Lambda implementation for serverless applications",
   "author": "exabugs",
   "license": "MIT",

package/terraform/main.tf

@@ -65,6 +65,31 @@ resource "aws_iam_role_policy" "records_dynamodb" {
   })
 }
 
+# カスタムインラインポリシー: KMSアクセス（Parameter Store用）
+# Lambda関数がSecureString環境変数を復号化するために必要
+resource "aws_iam_role_policy" "records_kms" {
+  name = "kms-access"
+  role = aws_iam_role.lambda_records.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "kms:Decrypt"
+        ]
+        Resource = "*"
+        Condition = {
+          StringEquals = {
+            "kms:ViaService" = "ssm.${var.region}.amazonaws.com"
+          }
+        }
+      }
+    ]
+  })
+}
+
 # CloudWatch Logsロググループ
 resource "aws_cloudwatch_log_group" "lambda_records" {
   name              = "/aws/lambda/${var.project_name}-${var.environment}-records"
@@ -127,7 +152,8 @@ resource "aws_lambda_function" "records" {
   # CloudWatch Logsへの依存関係を明示
   depends_on = [
     aws_cloudwatch_log_group.lambda_records,
-    aws_iam_role_policy.records_dynamodb
+    aws_iam_role_policy.records_dynamodb,
+    aws_iam_role_policy.records_kms
   ]
 
   tags = {
@@ -143,7 +169,7 @@ resource "aws_lambda_function_url" "records" {
   # CORS設定
   cors {
     allow_origins     = ["*"]
-    allow_methods     = ["POST"]
+    allow_methods     = ["GET", "POST", "PUT", "DELETE", "OPTIONS"]
     allow_headers     = ["content-type", "authorization", "x-amz-date", "x-api-key", "x-amz-security-token"]
     expose_headers    = ["content-type", "x-amzn-requestid"]
     allow_credentials = false