@exabugs/dynamodb-client 0.7.1 → 0.7.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/CHANGELOG.md +21 -0
  2. package/dist/server/handler.cjs +2 -2
  3. package/package.json +1 -1
  4. package/terraform/main.tf +27 -1
  5. package/terraform/modules/parameter-store/main.tf +30 -24
package/CHANGELOG.md CHANGED
@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
7
7
 
8
8
  ## [Unreleased]
9
9
 
10
+ ## [0.7.3] - 2025-12-28
11
+
12
+ ### Fixed
13
+
14
+ - **Lambda KMS Access**: Added AWS default KMS key access permissions for Lambda execution environment (ADR-003)
15
+ - **KMSAccessDeniedException**: Resolved Lambda startup failure due to missing KMS permissions
16
+ - **Lambda Runtime**: Added conditional access to default KMS key used by Lambda service for function protection
17
+
18
+ ### Security
19
+
20
+ - **KMS Permissions**: Limited KMS access to Lambda service only with conditional access control
21
+ - **Least Privilege**: Maintained security with service-specific KMS access restrictions
22
+
23
+ ## [0.7.2] - 2024-12-28
24
+
25
+ ### Fixed
26
+
27
+ - **Parameter Store**: Added overwrite=true to all SSM parameters to handle existing parameters
28
+ - Prevents ParameterAlreadyExists errors during Terraform apply
29
+ - Allows updating existing Parameter Store values without manual deletion
30
+
10
31
  ## [0.7.1] - 2024-12-28
11
32
 
12
33
  ### Fixed
package/dist/server/handler.cjs CHANGED
@@ -1,5 +1,5 @@
1
- // @exabugs/dynamodb-client v0.7.1
2
- // Built: 2025-12-28T10:05:34.251Z
1
+ // @exabugs/dynamodb-client v0.7.3
2
+ // Built: 2025-12-28T10:27:40.943Z
3
3
  "use strict";
4
4
  var __create = Object.create;
5
5
  var __defProp = Object.defineProperty;
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@exabugs/dynamodb-client",
3
- "version": "0.7.1",
3
+ "version": "0.7.3",
4
4
  "description": "DynamoDB Single-Table Client SDK with MongoDB-like API, Shadow Records, and Lambda implementation for serverless applications",
5
5
  "author": "exabugs",
6
6
  "license": "MIT",
package/terraform/main.tf CHANGED
@@ -90,6 +90,31 @@ resource "aws_iam_role_policy" "records_kms" {
90
90
  })
91
91
  }
92
92
 
93
+ # カスタムインラインポリシー: KMSデフォルトキーアクセス（Lambda実行環境用）
94
+ # AWS LambdaのデフォルトKMSキーへのアクセス権限（ADR-003）
95
+ resource "aws_iam_role_policy" "records_kms_default" {
96
+ name = "kms-default-access"
97
+ role = aws_iam_role.lambda_records.id
98
+
99
+ policy = jsonencode({
100
+ Version = "2012-10-17"
101
+ Statement = [
102
+ {
103
+ Effect = "Allow"
104
+ Action = [
105
+ "kms:Decrypt"
106
+ ]
107
+ Resource = "*"
108
+ Condition = {
109
+ StringEquals = {
110
+ "kms:ViaService" = "lambda.${var.region}.amazonaws.com"
111
+ }
112
+ }
113
+ }
114
+ ]
115
+ })
116
+ }
117
+
93
118
  # CloudWatch Logsロググループ
94
119
  resource "aws_cloudwatch_log_group" "lambda_records" {
95
120
  name = "/aws/lambda/${var.project_name}-${var.environment}-records"
@@ -153,7 +178,8 @@ resource "aws_lambda_function" "records" {
153
178
  depends_on = [
154
179
  aws_cloudwatch_log_group.lambda_records,
155
180
  aws_iam_role_policy.records_dynamodb,
156
- aws_iam_role_policy.records_kms
181
+ aws_iam_role_policy.records_kms,
182
+ aws_iam_role_policy.records_kms_default
157
183
  ]
158
184
 
159
185
  tags = {
package/terraform/modules/parameter-store/main.tf CHANGED
@@ -10,10 +10,11 @@ locals {
10
10
 
11
11
  # Records Lambda Function URL (外部参照用)
12
12
  resource "aws_ssm_parameter" "app_records_api_url" {
13
- name = "/${var.project_name}/${var.environment}/app/records-api-url"
14
- type = local.parameter_type
15
- tier = local.parameter_tier
16
- value = var.records_function_url
13
+ name = "/${var.project_name}/${var.environment}/app/records-api-url"
14
+ type = local.parameter_type
15
+ tier = local.parameter_tier
16
+ value = var.records_function_url
17
+ overwrite = true
17
18
 
18
19
  description = "Records Lambda Function URL"
19
20
 
@@ -26,10 +27,11 @@ resource "aws_ssm_parameter" "app_records_api_url" {
26
27
 
27
28
  # Records Lambda Function ARN (外部参照用)
28
29
  resource "aws_ssm_parameter" "lambda_records_function_arn" {
29
- name = "/${var.project_name}/${var.environment}/lambda/records-function-arn"
30
- type = local.parameter_type
31
- tier = local.parameter_tier
32
- value = var.records_function_arn
30
+ name = "/${var.project_name}/${var.environment}/lambda/records-function-arn"
31
+ type = local.parameter_type
32
+ tier = local.parameter_tier
33
+ value = var.records_function_arn
34
+ overwrite = true
33
35
 
34
36
  description = "Records Lambda Function ARN"
35
37
 
@@ -45,10 +47,11 @@ resource "aws_ssm_parameter" "lambda_records_function_arn" {
45
47
 
46
48
  # Cognito User Pool ID (Admin UI参照用)
47
49
  resource "aws_ssm_parameter" "app_admin_ui_cognito_user_pool_id" {
48
- name = "/${var.project_name}/${var.environment}/app/admin-ui/cognito-user-pool-id"
49
- type = local.parameter_type
50
- tier = local.parameter_tier
51
- value = var.cognito_user_pool_id
50
+ name = "/${var.project_name}/${var.environment}/app/admin-ui/cognito-user-pool-id"
51
+ type = local.parameter_type
52
+ tier = local.parameter_tier
53
+ value = var.cognito_user_pool_id
54
+ overwrite = true
52
55
 
53
56
  description = "Cognito User Pool ID for Admin UI"
54
57
 
@@ -61,10 +64,11 @@ resource "aws_ssm_parameter" "app_admin_ui_cognito_user_pool_id" {
61
64
 
62
65
  # Cognito Client ID (Admin UI参照用)
63
66
  resource "aws_ssm_parameter" "app_admin_ui_cognito_client_id" {
64
- name = "/${var.project_name}/${var.environment}/app/admin-ui/cognito-client-id"
65
- type = local.parameter_type
66
- tier = local.parameter_tier
67
- value = var.cognito_admin_ui_client_id
67
+ name = "/${var.project_name}/${var.environment}/app/admin-ui/cognito-client-id"
68
+ type = local.parameter_type
69
+ tier = local.parameter_tier
70
+ value = var.cognito_admin_ui_client_id
71
+ overwrite = true
68
72
 
69
73
  description = "Cognito Client ID for Admin UI"
70
74
 
@@ -77,10 +81,11 @@ resource "aws_ssm_parameter" "app_admin_ui_cognito_client_id" {
77
81
 
78
82
  # Cognito Domain (Admin UI参照用)
79
83
  resource "aws_ssm_parameter" "app_admin_ui_cognito_domain" {
80
- name = "/${var.project_name}/${var.environment}/app/admin-ui/cognito-domain"
81
- type = local.parameter_type
82
- tier = local.parameter_tier
83
- value = "${var.cognito_user_pool_domain}.auth.${var.region}.amazoncognito.com"
84
+ name = "/${var.project_name}/${var.environment}/app/admin-ui/cognito-domain"
85
+ type = local.parameter_type
86
+ tier = local.parameter_tier
87
+ value = "${var.cognito_user_pool_domain}.auth.${var.region}.amazoncognito.com"
88
+ overwrite = true
84
89
 
85
90
  description = "Cognito Domain for Admin UI"
86
91
 
@@ -93,10 +98,11 @@ resource "aws_ssm_parameter" "app_admin_ui_cognito_domain" {
93
98
 
94
99
  # DynamoDB Table Name (外部参照用)
95
100
  resource "aws_ssm_parameter" "infra_dynamodb_table_name" {
96
- name = "/${var.project_name}/${var.environment}/infra/dynamodb-table-name"
97
- type = local.parameter_type
98
- tier = local.parameter_tier
99
- value = var.dynamodb_table_name
101
+ name = "/${var.project_name}/${var.environment}/infra/dynamodb-table-name"
102
+ type = local.parameter_type
103
+ tier = local.parameter_tier
104
+ value = var.dynamodb_table_name
105
+ overwrite = true
100
106
 
101
107
  description = "DynamoDB Table Name"
102
108