@exabugs/dynamodb-client 1.6.0 → 1.6.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +22 -0
- package/README.md +1 -0
- package/dist/server/handler.cjs +10 -5
- package/dist/server/handler.cjs.map +2 -2
- package/dist/server/media-handler.cjs +2 -2
- package/dist/server/media-process-handler-dlq.cjs +2 -2
- package/dist/server/media-process-handler.cjs +2 -2
- package/dist/server/utils/auth.d.ts.map +1 -1
- package/dist/server/utils/auth.js +8 -0
- package/dist/server/utils/auth.js.map +1 -1
- package/dist/server/utils/authHandler.js +1 -1
- package/dist/server/utils/authHandler.js.map +1 -1
- package/dist/sharp-layer.zip +0 -0
- package/package.json +1 -1
- package/terraform/README.md +5 -0
- package/terraform/main.tf +2 -0
- package/terraform/modules/parameter-store/README.md +2 -0
- package/terraform/modules/parameter-store/main.tf +9 -1
- package/terraform/modules/parameter-store/variables.tf +6 -0
- package/terraform/variables.tf +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/utils/auth.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAMlE;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/utils/auth.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAMlE;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,iBAAiB,CAAC;AA2C3C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,CAAC,CAyCrB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAY7E;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,CAAC,CAGrB"}
|
|
@@ -24,6 +24,14 @@ let verifierInstance = null;
|
|
|
24
24
|
function getVerifier(userPoolId, clientId) {
|
|
25
25
|
if (!verifierInstance) {
|
|
26
26
|
logger.debug('Creating JWT verifier instance', { userPoolId, clientId });
|
|
27
|
+
if (!clientId) {
|
|
28
|
+
// aud を検証しないと、同じユーザープールの別アプリクライアントが発行したトークンも通る。
|
|
29
|
+
// 挙動は変えず（破壊的変更にしない）、気づけるように警告する。コールドスタートごとに1回。
|
|
30
|
+
logger.warn('COGNITO_CLIENT_ID is not set: JWT audience (aud) verification is DISABLED. ' +
|
|
31
|
+
'Tokens issued to ANY app client of this user pool are accepted. ' +
|
|
32
|
+
'Set cognito_client_id (Terraform) / COGNITO_CLIENT_ID in production. ' +
|
|
33
|
+
'See docs/AUTHORIZATION.md', { userPoolId });
|
|
34
|
+
}
|
|
27
35
|
verifierInstance = CognitoJwtVerifier.create({
|
|
28
36
|
userPoolId,
|
|
29
37
|
tokenUse: 'id', // ID トークンを検証
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/utils/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEzD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAQ3D;;;;;GAKG;AACH,IAAI,gBAAgB,GAAwD,IAAI,CAAC;AAEjF;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,UAAkB,EAAE,QAAiB;IACxD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEzE,gBAAgB,GAAG,kBAAkB,CAAC,MAAM,CAAC;YAC3C,UAAU;YACV,QAAQ,EAAE,IAAI,EAAE,aAAa;YAC7B,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,4CAA4C;SACzE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAa,EACb,UAAkB,EAClB,QAAiB;IAEjB,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAE9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEnD,mCAAmC;QACnC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE7C,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YAC9C,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,SAAS;SAC5B,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE;YACtC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QAEH,cAAc;QACd,IAAI,OAAO,GAAG,yBAAyB,CAAC;QACxC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtC,OAAO,GAAG,mBAAmB,CAAC;YAChC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACvD,OAAO,GAAG,yBAAyB,CAAC;YACtC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpD,OAAO,GAAG,sBAAsB,CAAC;YACnC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACtD,OAAO,GAAG,wBAAwB,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE;YAC3B,aAAa,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SACtE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAA8B;IACnE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAA8B,EAC9B,UAAkB,EAClB,QAAiB;IAEjB,MAAM,KAAK,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACjD,OAAO,MAAM,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC"}
|
|
1
|
+
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/utils/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEzD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAQ3D;;;;;GAKG;AACH,IAAI,gBAAgB,GAAwD,IAAI,CAAC;AAEjF;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,UAAkB,EAAE,QAAiB;IACxD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEzE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,gDAAgD;YAChD,+CAA+C;YAC/C,MAAM,CAAC,IAAI,CACT,6EAA6E;gBAC3E,kEAAkE;gBAClE,uEAAuE;gBACvE,2BAA2B,EAC7B,EAAE,UAAU,EAAE,CACf,CAAC;QACJ,CAAC;QAED,gBAAgB,GAAG,kBAAkB,CAAC,MAAM,CAAC;YAC3C,UAAU;YACV,QAAQ,EAAE,IAAI,EAAE,aAAa;YAC7B,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,4CAA4C;SACzE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAa,EACb,UAAkB,EAClB,QAAiB;IAEjB,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAE9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEnD,mCAAmC;QACnC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE7C,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YAC9C,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,SAAS;SAC5B,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE;YACtC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QAEH,cAAc;QACd,IAAI,OAAO,GAAG,yBAAyB,CAAC;QACxC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtC,OAAO,GAAG,mBAAmB,CAAC;YAChC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACvD,OAAO,GAAG,yBAAyB,CAAC;YACtC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpD,OAAO,GAAG,sBAAsB,CAAC;YACnC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACtD,OAAO,GAAG,wBAAwB,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE;YAC3B,aAAa,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SACtE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAA8B;IACnE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAA8B,EAC9B,UAAkB,EAClB,QAAiB;IAEjB,MAAM,KAAK,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACjD,OAAO,MAAM,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC"}
|
|
@@ -55,10 +55,10 @@ async function handleCognitoAuthentication(authHeader, requestId) {
|
|
|
55
55
|
throw new Error('COGNITO_USER_POOL_ID environment variable is required');
|
|
56
56
|
}
|
|
57
57
|
const jwtPayload = await verifyAuthHeader(authHeader, userPoolId, clientId);
|
|
58
|
+
// メールアドレスは個人情報のためログに出さない（追跡は sub で足りる）
|
|
58
59
|
logger.debug('Cognito JWT verified', {
|
|
59
60
|
requestId,
|
|
60
61
|
sub: jwtPayload.sub,
|
|
61
|
-
email: jwtPayload.email,
|
|
62
62
|
});
|
|
63
63
|
// TODO: テナント境界の実装
|
|
64
64
|
// jwtPayload.subをレコードのuserIdフィールドと照合する
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authHandler.js","sourceRoot":"","sources":["../../../src/server/utils/authHandler.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C;;GAEG;AACH,MAAM,MAAM,GAAG,YAAY,CAAC;IAC1B,OAAO,EAAE,cAAc;IACvB,KAAK,EAAG,OAAO,CAAC,GAAG,CAAC,SAAiD,IAAI,MAAM;CAChF,CAAC,CAAC;AA4BH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAmB,EACnB,SAAiB;IAEjB,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,CAAC;IAEjD,IAAI,GAAG,EAAE,CAAC;QACR,4DAA4D;QAC5D,uBAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IAED,4CAA4C;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;IAC9E,MAAM,2BAA2B,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,GAAyB,EAAE,SAAiB;IAC3E,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;QACvC,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,2BAA2B,CACxC,UAA8B,EAC9B,SAAiB;IAEjB,6BAA6B;IAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,QAAQ;IAExD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAE5E,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;QACnC,SAAS;QACT,GAAG,EAAE,UAAU,CAAC,GAAG;
|
|
1
|
+
{"version":3,"file":"authHandler.js","sourceRoot":"","sources":["../../../src/server/utils/authHandler.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C;;GAEG;AACH,MAAM,MAAM,GAAG,YAAY,CAAC;IAC1B,OAAO,EAAE,cAAc;IACvB,KAAK,EAAG,OAAO,CAAC,GAAG,CAAC,SAAiD,IAAI,MAAM;CAChF,CAAC,CAAC;AA4BH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAmB,EACnB,SAAiB;IAEjB,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,CAAC;IAEjD,IAAI,GAAG,EAAE,CAAC;QACR,4DAA4D;QAC5D,uBAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IAED,4CAA4C;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;IAC9E,MAAM,2BAA2B,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,GAAyB,EAAE,SAAiB;IAC3E,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;QACvC,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,2BAA2B,CACxC,UAA8B,EAC9B,SAAiB;IAEjB,6BAA6B;IAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,QAAQ;IAExD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAE5E,uCAAuC;IACvC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;QACnC,SAAS;QACT,GAAG,EAAE,UAAU,CAAC,GAAG;KACpB,CAAC,CAAC;IAEH,kBAAkB;IAClB,uCAAuC;AACzC,CAAC"}
|
package/dist/sharp-layer.zip
CHANGED
|
Binary file
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@exabugs/dynamodb-client",
|
|
3
|
-
"version": "1.6.
|
|
3
|
+
"version": "1.6.2",
|
|
4
4
|
"description": "DynamoDB Single-Table Client SDK with MongoDB-like API, Shadow Records, and Lambda implementation for serverless applications",
|
|
5
5
|
"author": "exabugs",
|
|
6
6
|
"license": "MIT",
|
package/terraform/README.md
CHANGED
|
@@ -61,6 +61,11 @@ module "lambda_records" {
|
|
|
61
61
|
}
|
|
62
62
|
```
|
|
63
63
|
|
|
64
|
+
## 注意
|
|
65
|
+
|
|
66
|
+
- **認可**: この Lambda は JWT の有効性しか検証しない。ユーザープールは管理者専用にし、`cognito_client_id` を必ず指定すること。詳細は [docs/AUTHORIZATION.md](../docs/AUTHORIZATION.md)
|
|
67
|
+
- **pnpm で `node_modules` 経由の参照をしている場合**: `node_modules/@exabugs/dynamodb-client` は版付きのパス（`.pnpm/@exabugs+dynamodb-client@<版>_…`）へのシンボリックリンク。Terraform は解決後の実パスを `.terraform/modules` に記録するため、**パッケージの版を上げた後は `.terraform/modules` を削除してから `terraform init` する**こと。しないと、古い版のコードで `plan` が走る
|
|
68
|
+
|
|
64
69
|
## 入力変数
|
|
65
70
|
|
|
66
71
|
### 必須変数
|
package/terraform/main.tf
CHANGED
|
@@ -213,6 +213,8 @@ module "parameter_store" {
|
|
|
213
213
|
# Records Lambda設定
|
|
214
214
|
records_function_url = aws_lambda_function_url.records.function_url
|
|
215
215
|
records_iam_function_url = aws_lambda_function_url.records_iam.function_url
|
|
216
|
+
# IAM URL は常に同じ apply で作るため true を明示する（未確定の値の有無で count を決めない）
|
|
217
|
+
create_records_iam_url_parameter = true
|
|
216
218
|
records_function_arn = aws_lambda_function.records.arn
|
|
217
219
|
|
|
218
220
|
# Cognito設定
|
|
@@ -31,6 +31,8 @@ module "parameter_store" {
|
|
|
31
31
|
}
|
|
32
32
|
```
|
|
33
33
|
|
|
34
|
+
AWS_IAM認証URL（サーバー間呼び出し・運用スクリプト向け）のパラメータも作る場合は、`records_iam_function_url` と一緒に `create_records_iam_url_parameter = true` を渡す。値に同じ apply で作成するリソースの属性を渡すと、初回の plan で値が未確定になり、値の有無では個数を決められないため。
|
|
35
|
+
|
|
34
36
|
**Note**: このモジュールは外部参照用のプレースホルダーパラメータも作成します。実際の値は他のTerraformモジュール（Cognito、DynamoDB等）から設定してください。
|
|
35
37
|
|
|
36
38
|
### プレースホルダーパラメータの更新
|
|
@@ -33,7 +33,15 @@ resource "aws_ssm_parameter" "infra_dynamodb_client_api_url" {
|
|
|
33
33
|
# DynamoDB Client API URL, AWS_IAM認証版 (外部参照用)
|
|
34
34
|
# サーバー間呼び出し・運用スクリプト（IAM署名クライアント）向け
|
|
35
35
|
resource "aws_ssm_parameter" "infra_dynamodb_client_api_iam_url" {
|
|
36
|
-
|
|
36
|
+
# 個数は plan 時に確定している必要がある。records_iam_function_url は、同じ apply で
|
|
37
|
+
# 作成する Function URL の属性（初回は未確定）を渡されることが多く、それで個数を決めると
|
|
38
|
+
# "Invalid count argument" になる。呼び出し元が create_records_iam_url_parameter で
|
|
39
|
+
# 明示した場合はそれに従う。未指定（null）のときだけ、従来どおり値の有無で判定する。
|
|
40
|
+
count = (
|
|
41
|
+
var.create_records_iam_url_parameter == null
|
|
42
|
+
? (var.records_iam_function_url != null ? 1 : 0)
|
|
43
|
+
: (var.create_records_iam_url_parameter ? 1 : 0)
|
|
44
|
+
)
|
|
37
45
|
|
|
38
46
|
name = "/${var.project_name}/${var.environment}/infra/dynamodb-client-api-iam-url"
|
|
39
47
|
type = local.parameter_type
|
|
@@ -26,6 +26,12 @@ variable "records_iam_function_url" {
|
|
|
26
26
|
default = null
|
|
27
27
|
}
|
|
28
28
|
|
|
29
|
+
variable "create_records_iam_url_parameter" {
|
|
30
|
+
description = "AWS_IAM認証URLのパラメータを作成するか。records_iam_function_url に同じ apply で作成するリソースの属性を渡す場合は true を明示する（値の有無で個数を決めると初回 plan が失敗するため）。null（既定）のときは records_iam_function_url が null でなければ作成する（従来の動作）"
|
|
31
|
+
type = bool
|
|
32
|
+
default = null
|
|
33
|
+
}
|
|
34
|
+
|
|
29
35
|
variable "records_function_arn" {
|
|
30
36
|
description = "Records Lambda Function ARN"
|
|
31
37
|
type = string
|
package/terraform/variables.tf
CHANGED
|
@@ -31,7 +31,7 @@ variable "cognito_user_pool_id" {
|
|
|
31
31
|
}
|
|
32
32
|
|
|
33
33
|
variable "cognito_client_id" {
|
|
34
|
-
description = "Cognito App Client ID（JWTのaud
|
|
34
|
+
description = "Cognito App Client ID（JWTのaud検証に使用）。本番では必ず指定すること。未指定だと aud を検証せず、同じユーザープールの別アプリクライアントが発行したトークンも通る（Lambda が起動時に警告ログを出す）。docs/AUTHORIZATION.md を参照"
|
|
35
35
|
type = string
|
|
36
36
|
default = null
|
|
37
37
|
}
|