@go-to-k/cdkd 0.222.1 → 0.223.1

package/dist/cli.js

@@ -1553,7 +1553,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.222.1";
+	return "0.223.1";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -5850,6 +5850,76 @@ var S3BucketProvider = class {
 //#endregion
 //#region src/provisioning/providers/s3-bucket-policy-provider.ts
 /**
+* Matches a CloudFront Origin Access Identity (OAI) principal ARN, e.g.
+* `arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E1UREC9EUJDVG5`.
+* The capture group is the OAI id, which resolves to the OAI's S3 canonical
+* user id via `GetCloudFrontOriginAccessIdentity`.
+*/
+const OAI_USER_ARN_RE = /^arn:aws[a-z-]*:iam::cloudfront:user\/CloudFront Origin Access Identity ([A-Z0-9]+)$/;
+/**
+* Matches a bare IAM principal unique id (e.g. `AIDAIBJOSOJSBZ753XCAW`). S3
+* returns an OAI grant's principal in this transient form immediately after
+* `PutBucketPolicy` (before it settles to the friendly cloudfront-user ARN).
+* It carries no recoverable link back to the OAI, so it can only be
+* canonicalized by matching against the template's `{ CanonicalUser }` form.
+*/
+const IAM_UNIQUE_ID_RE = /^A[A-Z0-9]{15,}$/;
+/**
+* Process-lifetime cache of OAI id -> S3 canonical user id (or `null` when the
+* lookup failed / the OAI is gone), so a `cdkd drift` run with many OAI-granting
+* bucket policies issues at most one `GetCloudFrontOriginAccessIdentity` per OAI.
+*/
+const oaiCanonicalUserIdCache = /* @__PURE__ */ new Map();
+/**
+* Build an `oaiId -> S3CanonicalUserId` map from the same-stack sibling
+* `AWS::CloudFront::CloudFrontOriginAccessIdentity` resources in the read
+* context. The OAI's `S3CanonicalUserId` is a readOnly attribute cdkd already
+* resolved at deploy time (the bucket-policy grant `Fn::GetAtt`s it), so this
+* lets the bucket-policy drift read reconcile the OAI principal forms with zero
+* extra AWS calls (and no `cloudfront:GetCloudFrontOriginAccessIdentity` IAM
+* grant) whenever the OAI lives in the same stack. The OAI resource's
+* `physicalId` IS the OAI id embedded in the cloudfront-user ARN.
+*/
+function buildSiblingOaiCanonicalMap(context) {
+	const map = /* @__PURE__ */ new Map();
+	for (const sib of Object.values(context?.siblings ?? {})) {
+		if (sib.resourceType !== "AWS::CloudFront::CloudFrontOriginAccessIdentity") continue;
+		const canonical = sib.attributes?.["S3CanonicalUserId"];
+		if (sib.physicalId && typeof canonical === "string") map.set(sib.physicalId, canonical);
+	}
+	return map;
+}
+/**
+* Pull the `Statement` array out of a parsed policy document, tolerating both
+* the single-object and array shapes (and a non-object input). Returns the live
+* statement objects so callers can mutate their `Principal` in place.
+*/
+function extractStatements(policyDoc) {
+	if (!policyDoc || typeof policyDoc !== "object") return [];
+	const stmt = policyDoc["Statement"];
+	return (Array.isArray(stmt) ? stmt : stmt ? [stmt] : []).filter((s) => !!s && typeof s === "object" && !Array.isArray(s));
+}
+/**
+* Find the `CanonicalUser` principal of the template statement that matches a
+* given AWS-side statement by Effect / Action / Resource, used to canonicalize
+* the unresolvable transient `{ AWS: <IAM-unique-id> }` OAI form. Returns
+* `undefined` when no single matching template statement carries one.
+*/
+function findTemplateCanonicalUser(awsStmt, templateStmts) {
+	const key = (s) => JSON.stringify([
+		s["Effect"],
+		s["Action"],
+		s["Resource"]
+	]);
+	const want = key(awsStmt);
+	const matches = templateStmts.filter((t) => key(t) === want);
+	if (matches.length !== 1) return void 0;
+	const principal = matches[0]["Principal"];
+	if (!principal || typeof principal !== "object" || Array.isArray(principal)) return void 0;
+	const canonical = principal["CanonicalUser"];
+	return typeof canonical === "string" ? canonical : void 0;
+}
+/**
 * AWS S3 Bucket Policy Provider
 *
 * Implements resource provisioning for AWS::S3::BucketPolicy using the S3 SDK.
@@ -5953,7 +6023,7 @@ var S3BucketPolicyProvider = class {
 	* Returns `undefined` when the bucket is gone (`NoSuchBucket`) or when
 	* no policy is currently attached (`NoSuchBucketPolicy`).
 	*/
-	async readCurrentState(physicalId, _logicalId, _resourceType) {
+	async readCurrentState(physicalId, _logicalId, _resourceType, properties, context) {
 		let policyJson;
 		try {
 			policyJson = (await this.s3Client.send(new GetBucketPolicyCommand({ Bucket: physicalId }))).Policy;
@@ -5964,14 +6034,90 @@ var S3BucketPolicyProvider = class {
 		}
 		if (!policyJson) return void 0;
 		const result = { Bucket: physicalId };
+		let policyDoc;
 		try {
-			result["PolicyDocument"] = JSON.parse(policyJson);
+			policyDoc = JSON.parse(policyJson);
 		} catch {
 			result["PolicyDocument"] = policyJson;
+			return result;
 		}
+		await this.normalizeOaiPrincipals(policyDoc, properties, context);
+		result["PolicyDocument"] = policyDoc;
 		return result;
 	}
 	/**
+	* Normalize CloudFront OAI grant principals in a (parsed) bucket policy to
+	* the `{ CanonicalUser: <id> }` form, in place (issue #872):
+	*   - `{ AWS: <oai-user-arn> }` -> map the OAI id in the ARN to its
+	*     `S3CanonicalUserId`, preferring the sibling OAI resource's already-read
+	*     state attributes (zero AWS call — the OAI's `S3CanonicalUserId` is a
+	*     readOnly attribute cdkd already resolved at deploy time) and falling
+	*     back to `GetCloudFrontOriginAccessIdentity` only when the OAI is not a
+	*     same-stack sibling (e.g. an imported / external OAI). This is the SAFE
+	*     path: a genuinely-different OAI resolves to a different canonical id, so
+	*     real drift is still detected.
+	*   - `{ AWS: <bare-IAM-unique-id> }` -> the transient post-PutBucketPolicy
+	*     rendering, which carries no recoverable link to the OAI. Canonicalize
+	*     it only by matching the corresponding template statement (same Effect /
+	*     Action / Resource) carrying a `{ CanonicalUser }` principal. A user
+	*     cannot author a bare IAM unique id as a bucket-policy principal, so
+	*     adopting the template form here only fires for AWS's transient
+	*     rendering. NOTE: once the principal settles to the ARN form (seconds
+	*     to minutes), a genuine out-of-band OAI repoint IS detected via the ARN
+	*     path above; the only masking window is a repoint observed during the
+	*     transient bare-id phase, which the next drift run (ARN form) reports.
+	* Statements whose principal is not a single-string `AWS` OAI form (e.g. a
+	* wildcard, a service principal, a normal role ARN, or an `AWS` ARRAY of
+	* principals) are left untouched — skipping is safe (it can only leave a
+	* residual false positive, never hide real drift). CDK's single-OAI grant
+	* emits the single-string form.
+	*/
+	async normalizeOaiPrincipals(policyDoc, templateProps, context) {
+		const stmts = extractStatements(policyDoc);
+		if (stmts.length === 0) return;
+		const templateStmts = extractStatements(templateProps?.["PolicyDocument"]);
+		const siblingCanonicalById = buildSiblingOaiCanonicalMap(context);
+		for (const stmt of stmts) {
+			const principal = stmt["Principal"];
+			if (!principal || typeof principal !== "object" || Array.isArray(principal)) continue;
+			const awsPrincipal = principal["AWS"];
+			if (typeof awsPrincipal !== "string") continue;
+			const arnMatch = OAI_USER_ARN_RE.exec(awsPrincipal);
+			if (arnMatch) {
+				const oaiId = arnMatch[1];
+				const canonical = siblingCanonicalById.get(oaiId) ?? await this.resolveOaiCanonicalUserId(oaiId);
+				if (canonical) stmt["Principal"] = { CanonicalUser: canonical };
+				continue;
+			}
+			if (IAM_UNIQUE_ID_RE.test(awsPrincipal)) {
+				const tmplCanonical = findTemplateCanonicalUser(stmt, templateStmts);
+				if (tmplCanonical) stmt["Principal"] = { CanonicalUser: tmplCanonical };
+			}
+		}
+	}
+	/**
+	* Resolve a CloudFront OAI id to its S3 canonical user id via
+	* `GetCloudFrontOriginAccessIdentity`, cached for the process lifetime. Used
+	* only as a FALLBACK when the OAI is not a same-stack sibling (its
+	* `S3CanonicalUserId` is otherwise read straight from sibling state — see
+	* {@link buildSiblingOaiCanonicalMap}). Best-effort: returns `null` (and
+	* caches it) on any failure so a missing OAI / missing permission leaves the
+	* principal unchanged rather than failing the drift read.
+	*/
+	async resolveOaiCanonicalUserId(oaiId) {
+		const cached = oaiCanonicalUserIdCache.get(oaiId);
+		if (cached !== void 0) return cached;
+		let canonical = null;
+		try {
+			canonical = (await getAwsClients().cloudFront.send(new GetCloudFrontOriginAccessIdentityCommand({ Id: oaiId }))).CloudFrontOriginAccessIdentity?.S3CanonicalUserId ?? null;
+		} catch (err) {
+			this.logger.debug(`Could not resolve CloudFront OAI ${oaiId} canonical user id for bucket-policy drift normalization: ${err instanceof Error ? err.message : String(err)} — leaving the principal unchanged.`);
+			canonical = null;
+		}
+		oaiCanonicalUserIdCache.set(oaiId, canonical);
+		return canonical;
+	}
+	/**
 	* Adopt an existing S3 bucket policy into cdkd state.
 	*
 	* The operational identifier for an `S3::BucketPolicy` is the **bucket
@@ -18384,6 +18530,88 @@ var CloudFrontDistributionProvider = class {
 		}
 	}
 	/**
+	* Read the AWS-current `DistributionConfig` for drift detection.
+	*
+	* Calls the read-only `GetDistributionConfigCommand` and inverts the
+	* provider's own `convertToSdkFormat` (the CFn-shape → SDK-shape
+	* `{ Quantity, Items }` mapping the create / update path applies) back
+	* into the CloudFormation `DistributionConfig` shape that cdkd state
+	* stores — so the drift comparator sees the same structure on both
+	* the deploy-time observed snapshot and a later drift read.
+	*
+	* The comparator only descends into keys present in cdkd state (or the
+	* union of state + AWS when an observed baseline exists), so this does
+	* not need to surface every AWS-injected field; it returns the same
+	* `DistributionConfig` / `Tags` keys the provider manages.
+	*
+	* `CallerReference` (a create-time idempotency token AWS echoes back
+	* but CDK never templates) is dropped so it cannot fire phantom drift.
+	* The remaining write-only / never-readable sub-fields are declared in
+	* `getDriftUnknownPaths`.
+	*/
+	async readCurrentState(physicalId, _logicalId, resourceType, _properties) {
+		if (resourceType !== "AWS::CloudFront::Distribution") return void 0;
+		let config;
+		try {
+			config = (await this.cloudFrontClient.send(new GetDistributionConfigCommand({ Id: physicalId }))).DistributionConfig;
+		} catch (error) {
+			if (error instanceof NoSuchDistribution) return void 0;
+			throw error;
+		}
+		if (!config) return void 0;
+		const result = { DistributionConfig: this.convertToCfnFormat(config) };
+		try {
+			const arn = (await this.cloudFrontClient.send(new GetDistributionCommand({ Id: physicalId }))).Distribution?.ARN;
+			if (arn) {
+				const cfnTags = ((await this.cloudFrontClient.send(new ListTagsForResourceCommand$3({ Resource: arn }))).Tags?.Items ?? []).filter((t) => typeof t.Key === "string" && !t.Key.startsWith("aws:cdk:")).map((t) => ({
+					Key: t.Key,
+					Value: t.Value ?? ""
+				}));
+				if (cfnTags.length > 0) result["Tags"] = cfnTags;
+			}
+		} catch (error) {
+			this.logger.debug(`Tag read for CloudFront Distribution ${physicalId} failed during drift read: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		return result;
+	}
+	/**
+	* State property paths cdkd cannot read back faithfully from AWS, so
+	* the drift comparator skips them rather than firing a guaranteed
+	* false positive every run (mirrors the Lambda `Code.S3*` precedent).
+	*
+	* - `DistributionConfig.CallerReference`: a create-time idempotency
+	*   token. cdkd generates it internally (`<ts>-<logicalId>-<rand>`);
+	*   AWS echoes it back, but it is never templated by CDK, so comparing
+	*   it would diff cdkd's generated value on every run. `convertToCfnFormat`
+	*   already drops it from the AWS side; declaring it here also excludes
+	*   it from the observed-baseline side.
+	* - `DistributionConfig.Logging.Bucket`: CloudFront normalizes the S3
+	*   logging bucket to its `<bucket>.s3.amazonaws.com` regional domain on
+	*   read, which never matches the bare bucket domain a template may
+	*   carry; treat it as drift-unknown to avoid a guaranteed mismatch.
+	* - `DistributionConfig.OriginGroups`: each origin group carries its own
+	*   inner `{ Quantity, Items }` wrappers (`Members`,
+	*   `FailoverCriteria.StatusCodes`) that `convertToCfnFormat` does not yet
+	*   unwrap symmetrically (only the top-level OriginGroups list is unwrapped;
+	*   there is no `revertOriginGroup` pass, and `convertToSdkFormat` likewise
+	*   does not descend into them). Against the observed baseline both sides go
+	*   through the same `readCurrentState` so this never false-positives on a
+	*   normal deploy, but against the `properties`-fallback baseline (older
+	*   state without `observedProperties`) the raw `{ Quantity, Items }` shape
+	*   would diff the bare-array template form. Suppress it until a dedicated
+	*   fix lands a `revertOriginGroup` + a real OriginGroups integ fixture
+	*   (there is no OriginGroups fixture to verify the inner shape today). See
+	*   the PR #871 review thread.
+	*/
+	getDriftUnknownPaths(resourceType) {
+		if (resourceType !== "AWS::CloudFront::Distribution") return [];
+		return [
+			"DistributionConfig.CallerReference",
+			"DistributionConfig.Logging.Bucket",
+			"DistributionConfig.OriginGroups"
+		];
+	}
+	/**
 	* Get resource attribute (for Fn::GetAtt resolution)
 	*/
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -18462,6 +18690,105 @@ var CloudFrontDistributionProvider = class {
 		return result;
 	}
 	/**
+	* Invert {@link convertToSdkFormat}: map an AWS-returned SDK-shape
+	* `DistributionConfig` ({@link GetDistributionConfigCommand} output) back
+	* into the CloudFormation `DistributionConfig` shape cdkd state stores.
+	*
+	* The inversion is the mirror image of the create / update conversion:
+	* every `{ Quantity, Items }` wrapper becomes its bare `Items` array
+	* (top-level list fields + the nested cache-behavior / origin fields),
+	* and `CallerReference` is dropped (a create-time idempotency token CDK
+	* never templates — see `getDriftUnknownPaths`).
+	*
+	* Lossiness note: the conversion is NOT perfectly lossless because
+	* `convertToSdkFormat` injects SDK-required defaults the CFn template may
+	* omit (`Comment: ''`, `Logging.{Enabled,IncludeCookies,Prefix}`,
+	* `CustomOriginConfig.HTTP{,S}Port`). Those defaults are preserved on the
+	* inverted side, which is correct for the drift comparator: the
+	* deploy-time observed baseline (also produced by THIS method) carries the
+	* same defaults, so they compare equal. They would only matter against the
+	* `properties` fallback baseline (resources with no observedProperties),
+	* where an AWS-injected default the template omitted is legitimately a
+	* key cdkd never set — but the comparator's state-keys-only walk in that
+	* mode never descends into a key absent from the template, so the extra
+	* defaults cannot fire false drift there either.
+	*/
+	convertToCfnFormat(config) {
+		const result = { ...config };
+		delete result["CallerReference"];
+		for (const field of QUANTITY_ITEM_FIELDS) if (result[field] !== void 0) result[field] = this.unwrapQuantity(result[field]);
+		if (result["DefaultCacheBehavior"] && typeof result["DefaultCacheBehavior"] === "object") result["DefaultCacheBehavior"] = this.revertCacheBehavior(result["DefaultCacheBehavior"]);
+		if (Array.isArray(result["CacheBehaviors"])) result["CacheBehaviors"] = result["CacheBehaviors"].map((cb) => this.revertCacheBehavior(cb));
+		if (Array.isArray(result["Origins"])) result["Origins"] = result["Origins"].map((origin) => this.revertOrigin(origin));
+		return result;
+	}
+	/**
+	* Inverse of {@link wrapWithQuantity}: a `{ Quantity, Items }` object
+	* becomes its bare `Items` array; anything else is returned unchanged.
+	*/
+	unwrapQuantity(value) {
+		if (value && typeof value === "object" && !Array.isArray(value)) {
+			const obj = value;
+			if (Array.isArray(obj["Items"])) return obj["Items"];
+		}
+		return value;
+	}
+	/**
+	* Inverse of {@link convertCacheBehavior}: unwrap the Quantity + Items
+	* fields nested inside a CacheBehavior back to bare arrays.
+	*/
+	revertCacheBehavior(behavior) {
+		const result = { ...behavior };
+		if (result["AllowedMethods"] && typeof result["AllowedMethods"] === "object") {
+			const allowed = result["AllowedMethods"];
+			if (allowed["CachedMethods"] !== void 0 && result["CachedMethods"] === void 0) {
+				result["CachedMethods"] = allowed["CachedMethods"];
+				const allowedCopy = { ...allowed };
+				delete allowedCopy["CachedMethods"];
+				result["AllowedMethods"] = allowedCopy;
+			}
+		}
+		for (const fieldPath of CACHE_BEHAVIOR_QUANTITY_FIELDS) {
+			const parts = fieldPath.split(".");
+			this.unwrapQuantityAtPath(result, parts);
+		}
+		return result;
+	}
+	/**
+	* Inverse of {@link convertOrigin}: unwrap CustomHeaders and
+	* CustomOriginConfig.OriginSslProtocols back to bare arrays.
+	*/
+	revertOrigin(origin) {
+		const result = { ...origin };
+		if (result["CustomHeaders"] !== void 0) result["CustomHeaders"] = this.unwrapQuantity(result["CustomHeaders"]);
+		if (result["CustomOriginConfig"] && typeof result["CustomOriginConfig"] === "object") {
+			const customOriginConfig = { ...result["CustomOriginConfig"] };
+			if (customOriginConfig["OriginSslProtocols"] !== void 0) customOriginConfig["OriginSslProtocols"] = this.unwrapQuantity(customOriginConfig["OriginSslProtocols"]);
+			result["CustomOriginConfig"] = customOriginConfig;
+		}
+		return result;
+	}
+	/**
+	* Inverse of {@link applyQuantityAtPath}: unwrap a `{ Quantity, Items }`
+	* value at a nested path (e.g. "ForwardedValues.Headers") back to a bare
+	* array.
+	*/
+	unwrapQuantityAtPath(obj, path) {
+		if (path.length === 0) return;
+		if (path.length === 1) {
+			const key = path[0];
+			if (obj[key] !== void 0) obj[key] = this.unwrapQuantity(obj[key]);
+			return;
+		}
+		const [head, ...rest] = path;
+		const headKey = head;
+		if (obj[headKey] && typeof obj[headKey] === "object") {
+			const nested = { ...obj[headKey] };
+			obj[headKey] = nested;
+			this.unwrapQuantityAtPath(nested, rest);
+		}
+	}
+	/**
 	* Wrap a value with the Quantity + Items pattern if needed.
 	*
 	* Handles three cases:
@@ -38233,7 +38560,9 @@ function buildReadCurrentStateContext(state, excludedLogicalId) {
 		if (lid === excludedLogicalId) continue;
 		siblings[lid] = {
 			resourceType: res.resourceType,
-			properties: res.properties ?? {}
+			physicalId: res.physicalId,
+			properties: res.properties ?? {},
+			attributes: res.attributes ?? {}
 		};
 	}
 	return { siblings };
@@ -54198,7 +54527,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.222.1");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.223.1");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());