@fjall/components-infrastructure 2.19.6 → 2.20.0

package/dist/lib/config/aws/oidcConnector.js

@@ -1,25 +1,89 @@
 import { CfnOutput, Duration } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
+import { Runtime } from "aws-cdk-lib/aws-lambda";
 import { Construct } from "constructs";
 import { Role } from "../../resources/aws/iam/role.js";
+import { CustomResource } from "../../resources/aws/utilities/customResource.js";
+/**
+ * The `https://fjall.io` OIDC provider is an account-global IAM singleton
+ * (one per account+URL). Both this construct AND the Quick-Create template can
+ * provision it, so it MUST be adopt-if-exists, not raw-create: a bare
+ * `new iam.OpenIdConnectProvider(...)` throws `EntityAlreadyExistsException`
+ * the moment the other source got there first (the mis-root collision class).
+ * The custom resource lists-then-adopts the existing provider (creating it only
+ * when absent) and NEVER deletes it on stack teardown — other deploy roles in
+ * the account federate the same singleton.
+ */
+const OIDC_PROVIDER_HANDLER = `
+const { IAMClient, ListOpenIDConnectProvidersCommand, GetOpenIDConnectProviderCommand, CreateOpenIDConnectProviderCommand, AddClientIDToOpenIDConnectProviderCommand } = require('@aws-sdk/client-iam');
+
+const AUDIENCE = 'sts.amazonaws.com';
+const THUMBPRINT = '0000000000000000000000000000000000000000';
+
+exports.handler = async (event) => {
+  const physicalId = event.PhysicalResourceId || event.LogicalResourceId;
+  // Never delete the account-global singleton — shared with the Quick-Create
+  // stack and federated by other deploy roles.
+  if (event.RequestType === 'Delete') {
+    return { PhysicalResourceId: physicalId };
+  }
+  const issuerUrl = event.ResourceProperties.IssuerUrl;
+  const host = new URL(issuerUrl).host;
+  const iam = new IAMClient({});
+  const list = await iam.send(new ListOpenIDConnectProvidersCommand({}));
+  const suffix = ':oidc-provider/' + host;
+  let arn = (list.OpenIDConnectProviderList || [])
+    .map((p) => p.Arn)
+    .find((a) => typeof a === 'string' && a.endsWith(suffix));
+  if (!arn) {
+    const created = await iam.send(new CreateOpenIDConnectProviderCommand({
+      Url: issuerUrl,
+      ClientIDList: [AUDIENCE],
+      ThumbprintList: [THUMBPRINT],
+    }));
+    arn = created.OpenIDConnectProviderArn;
+  } else {
+    const got = await iam.send(new GetOpenIDConnectProviderCommand({ OpenIDConnectProviderArn: arn }));
+    if (!(got.ClientIDList || []).includes(AUDIENCE)) {
+      await iam.send(new AddClientIDToOpenIDConnectProviderCommand({ OpenIDConnectProviderArn: arn, ClientID: AUDIENCE }));
+    }
+  }
+  return { PhysicalResourceId: arn, Data: { ProviderArn: arn } };
+};`;
 export class OidcConnector extends Construct {
     deployRoleArn;
     constructor(scope, id, props) {
         super(scope, id);
         const issuerDomain = "fjall.io";
         const issuerUrl = `https://${issuerDomain}`;
-        const provider = new iam.OpenIdConnectProvider(this, "OidcProvider", {
-            url: issuerUrl,
-            clientIds: ["sts.amazonaws.com"],
-            // Placeholder thumbprint. CDK auto-resolves at deploy time for known IdPs;
-            // STS trust is enforced via the OIDC issuer URL + `:sub` / `:aud` match.
-            thumbprints: ["0000000000000000000000000000000000000000"]
+        const providerResource = new CustomResource(this, "OidcProvider", {
+            runtime: Runtime.NODEJS_22_X,
+            timeout: Duration.minutes(5),
+            lambdaDescription: "Adopt-or-create the account-global Fjall OIDC provider",
+            resourceType: "Custom::FjallOidcProvider",
+            properties: { IssuerUrl: issuerUrl },
+            inlinePolicy: [
+                new iam.PolicyStatement({
+                    effect: iam.Effect.ALLOW,
+                    actions: [
+                        "iam:ListOpenIDConnectProviders",
+                        "iam:GetOpenIDConnectProvider",
+                        "iam:CreateOpenIDConnectProvider",
+                        "iam:AddClientIDToOpenIDConnectProvider"
+                    ],
+                    resources: ["*"]
+                })
+            ],
+            inlineCode: OIDC_PROVIDER_HANDLER
         });
+        const providerArn = providerResource.resource
+            .getAtt("ProviderArn")
+            .toString();
         const deployRole = new Role(this, "DeployRole", {
             roleName: `FjallDeploy${props.fjallOrgId}`,
             path: "/fjall/",
             maxSessionDuration: Duration.hours(1),
-            assumedBy: new iam.FederatedPrincipal(provider.openIdConnectProviderArn, {
+            assumedBy: new iam.FederatedPrincipal(providerArn, {
                 StringEquals: { [`${issuerDomain}:aud`]: "sts.amazonaws.com" },
                 StringLike: {
                     [`${issuerDomain}:sub`]: `org:${props.fjallOrgId}:*`
@@ -38,7 +102,7 @@ export class OidcConnector extends Construct {
         });
         new CfnOutput(this, "OidcProviderArn", {
             key: "OidcProviderArn",
-            value: provider.openIdConnectProviderArn,
+            value: providerArn,
             exportName: "OidcProviderArn",
             description: "ARN of the Fjall OIDC provider"
         });

package/dist/lib/resources/aws/utilities/customResource.d.ts

@@ -15,6 +15,13 @@ interface CustomResourceProps {
     properties?: {
         [key: string]: string;
     };
+    /**
+     * CloudFormation resource type for the custom resource (must begin with
+     * `Custom::`). Defaults to `AWS::CloudFormation::CustomResource`; set a
+     * `Custom::<Name>` value to make the resource self-identifying in the CFN
+     * console and addressable by type in synth assertions.
+     */
+    resourceType?: string;
     codePath?: string;
     inlineCode?: string;
     assetOptions?: AssetOptions;

package/dist/lib/resources/aws/utilities/customResource.js

@@ -58,7 +58,10 @@ export class CustomResource extends Construct {
         });
         this.resource = new customResource(this, `${id}Resource`, {
             serviceToken: provider.serviceToken,
-            properties: props.properties
+            properties: props.properties,
+            ...(props.resourceType !== undefined && {
+                resourceType: props.resourceType
+            })
         });
         this.response = this.resource.getAtt("Response").toString();
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "2.19.6",
+  "version": "2.20.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -63,8 +63,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^2.19.6",
-    "@fjall/util": "^2.19.6",
+    "@fjall/generator": "^2.20.0",
+    "@fjall/util": "^2.20.0",
     "constructs": "^10.0.0"
   },
   "overrides": {
@@ -78,5 +78,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "f41aae2245b7e82af7e8e7f5cf098b83b22cc198"
+  "gitHead": "ec556d44a8a32fbdc1a2e1ca3c1f22224b0d27c2"
 }