@go-to-k/cdkd 0.223.0 → 0.223.2

package/dist/cli.js

@@ -1553,7 +1553,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.223.0";
+	return "0.223.2";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -5850,6 +5850,76 @@ var S3BucketProvider = class {
 //#endregion
 //#region src/provisioning/providers/s3-bucket-policy-provider.ts
 /**
+* Matches a CloudFront Origin Access Identity (OAI) principal ARN, e.g.
+* `arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E1UREC9EUJDVG5`.
+* The capture group is the OAI id, which resolves to the OAI's S3 canonical
+* user id via `GetCloudFrontOriginAccessIdentity`.
+*/
+const OAI_USER_ARN_RE = /^arn:aws[a-z-]*:iam::cloudfront:user\/CloudFront Origin Access Identity ([A-Z0-9]+)$/;
+/**
+* Matches a bare IAM principal unique id (e.g. `AIDAIBJOSOJSBZ753XCAW`). S3
+* returns an OAI grant's principal in this transient form immediately after
+* `PutBucketPolicy` (before it settles to the friendly cloudfront-user ARN).
+* It carries no recoverable link back to the OAI, so it can only be
+* canonicalized by matching against the template's `{ CanonicalUser }` form.
+*/
+const IAM_UNIQUE_ID_RE = /^A[A-Z0-9]{15,}$/;
+/**
+* Process-lifetime cache of OAI id -> S3 canonical user id (or `null` when the
+* lookup failed / the OAI is gone), so a `cdkd drift` run with many OAI-granting
+* bucket policies issues at most one `GetCloudFrontOriginAccessIdentity` per OAI.
+*/
+const oaiCanonicalUserIdCache = /* @__PURE__ */ new Map();
+/**
+* Build an `oaiId -> S3CanonicalUserId` map from the same-stack sibling
+* `AWS::CloudFront::CloudFrontOriginAccessIdentity` resources in the read
+* context. The OAI's `S3CanonicalUserId` is a readOnly attribute cdkd already
+* resolved at deploy time (the bucket-policy grant `Fn::GetAtt`s it), so this
+* lets the bucket-policy drift read reconcile the OAI principal forms with zero
+* extra AWS calls (and no `cloudfront:GetCloudFrontOriginAccessIdentity` IAM
+* grant) whenever the OAI lives in the same stack. The OAI resource's
+* `physicalId` IS the OAI id embedded in the cloudfront-user ARN.
+*/
+function buildSiblingOaiCanonicalMap(context) {
+	const map = /* @__PURE__ */ new Map();
+	for (const sib of Object.values(context?.siblings ?? {})) {
+		if (sib.resourceType !== "AWS::CloudFront::CloudFrontOriginAccessIdentity") continue;
+		const canonical = sib.attributes?.["S3CanonicalUserId"];
+		if (sib.physicalId && typeof canonical === "string") map.set(sib.physicalId, canonical);
+	}
+	return map;
+}
+/**
+* Pull the `Statement` array out of a parsed policy document, tolerating both
+* the single-object and array shapes (and a non-object input). Returns the live
+* statement objects so callers can mutate their `Principal` in place.
+*/
+function extractStatements(policyDoc) {
+	if (!policyDoc || typeof policyDoc !== "object") return [];
+	const stmt = policyDoc["Statement"];
+	return (Array.isArray(stmt) ? stmt : stmt ? [stmt] : []).filter((s) => !!s && typeof s === "object" && !Array.isArray(s));
+}
+/**
+* Find the `CanonicalUser` principal of the template statement that matches a
+* given AWS-side statement by Effect / Action / Resource, used to canonicalize
+* the unresolvable transient `{ AWS: <IAM-unique-id> }` OAI form. Returns
+* `undefined` when no single matching template statement carries one.
+*/
+function findTemplateCanonicalUser(awsStmt, templateStmts) {
+	const key = (s) => JSON.stringify([
+		s["Effect"],
+		s["Action"],
+		s["Resource"]
+	]);
+	const want = key(awsStmt);
+	const matches = templateStmts.filter((t) => key(t) === want);
+	if (matches.length !== 1) return void 0;
+	const principal = matches[0]["Principal"];
+	if (!principal || typeof principal !== "object" || Array.isArray(principal)) return void 0;
+	const canonical = principal["CanonicalUser"];
+	return typeof canonical === "string" ? canonical : void 0;
+}
+/**
 * AWS S3 Bucket Policy Provider
 *
 * Implements resource provisioning for AWS::S3::BucketPolicy using the S3 SDK.
@@ -5953,7 +6023,7 @@ var S3BucketPolicyProvider = class {
 	* Returns `undefined` when the bucket is gone (`NoSuchBucket`) or when
 	* no policy is currently attached (`NoSuchBucketPolicy`).
 	*/
-	async readCurrentState(physicalId, _logicalId, _resourceType) {
+	async readCurrentState(physicalId, _logicalId, _resourceType, properties, context) {
 		let policyJson;
 		try {
 			policyJson = (await this.s3Client.send(new GetBucketPolicyCommand({ Bucket: physicalId }))).Policy;
@@ -5964,14 +6034,90 @@ var S3BucketPolicyProvider = class {
 		}
 		if (!policyJson) return void 0;
 		const result = { Bucket: physicalId };
+		let policyDoc;
 		try {
-			result["PolicyDocument"] = JSON.parse(policyJson);
+			policyDoc = JSON.parse(policyJson);
 		} catch {
 			result["PolicyDocument"] = policyJson;
+			return result;
 		}
+		await this.normalizeOaiPrincipals(policyDoc, properties, context);
+		result["PolicyDocument"] = policyDoc;
 		return result;
 	}
 	/**
+	* Normalize CloudFront OAI grant principals in a (parsed) bucket policy to
+	* the `{ CanonicalUser: <id> }` form, in place (issue #872):
+	*   - `{ AWS: <oai-user-arn> }` -> map the OAI id in the ARN to its
+	*     `S3CanonicalUserId`, preferring the sibling OAI resource's already-read
+	*     state attributes (zero AWS call — the OAI's `S3CanonicalUserId` is a
+	*     readOnly attribute cdkd already resolved at deploy time) and falling
+	*     back to `GetCloudFrontOriginAccessIdentity` only when the OAI is not a
+	*     same-stack sibling (e.g. an imported / external OAI). This is the SAFE
+	*     path: a genuinely-different OAI resolves to a different canonical id, so
+	*     real drift is still detected.
+	*   - `{ AWS: <bare-IAM-unique-id> }` -> the transient post-PutBucketPolicy
+	*     rendering, which carries no recoverable link to the OAI. Canonicalize
+	*     it only by matching the corresponding template statement (same Effect /
+	*     Action / Resource) carrying a `{ CanonicalUser }` principal. A user
+	*     cannot author a bare IAM unique id as a bucket-policy principal, so
+	*     adopting the template form here only fires for AWS's transient
+	*     rendering. NOTE: once the principal settles to the ARN form (seconds
+	*     to minutes), a genuine out-of-band OAI repoint IS detected via the ARN
+	*     path above; the only masking window is a repoint observed during the
+	*     transient bare-id phase, which the next drift run (ARN form) reports.
+	* Statements whose principal is not a single-string `AWS` OAI form (e.g. a
+	* wildcard, a service principal, a normal role ARN, or an `AWS` ARRAY of
+	* principals) are left untouched — skipping is safe (it can only leave a
+	* residual false positive, never hide real drift). CDK's single-OAI grant
+	* emits the single-string form.
+	*/
+	async normalizeOaiPrincipals(policyDoc, templateProps, context) {
+		const stmts = extractStatements(policyDoc);
+		if (stmts.length === 0) return;
+		const templateStmts = extractStatements(templateProps?.["PolicyDocument"]);
+		const siblingCanonicalById = buildSiblingOaiCanonicalMap(context);
+		for (const stmt of stmts) {
+			const principal = stmt["Principal"];
+			if (!principal || typeof principal !== "object" || Array.isArray(principal)) continue;
+			const awsPrincipal = principal["AWS"];
+			if (typeof awsPrincipal !== "string") continue;
+			const arnMatch = OAI_USER_ARN_RE.exec(awsPrincipal);
+			if (arnMatch) {
+				const oaiId = arnMatch[1];
+				const canonical = siblingCanonicalById.get(oaiId) ?? await this.resolveOaiCanonicalUserId(oaiId);
+				if (canonical) stmt["Principal"] = { CanonicalUser: canonical };
+				continue;
+			}
+			if (IAM_UNIQUE_ID_RE.test(awsPrincipal)) {
+				const tmplCanonical = findTemplateCanonicalUser(stmt, templateStmts);
+				if (tmplCanonical) stmt["Principal"] = { CanonicalUser: tmplCanonical };
+			}
+		}
+	}
+	/**
+	* Resolve a CloudFront OAI id to its S3 canonical user id via
+	* `GetCloudFrontOriginAccessIdentity`, cached for the process lifetime. Used
+	* only as a FALLBACK when the OAI is not a same-stack sibling (its
+	* `S3CanonicalUserId` is otherwise read straight from sibling state — see
+	* {@link buildSiblingOaiCanonicalMap}). Best-effort: returns `null` (and
+	* caches it) on any failure so a missing OAI / missing permission leaves the
+	* principal unchanged rather than failing the drift read.
+	*/
+	async resolveOaiCanonicalUserId(oaiId) {
+		const cached = oaiCanonicalUserIdCache.get(oaiId);
+		if (cached !== void 0) return cached;
+		let canonical = null;
+		try {
+			canonical = (await getAwsClients().cloudFront.send(new GetCloudFrontOriginAccessIdentityCommand({ Id: oaiId }))).CloudFrontOriginAccessIdentity?.S3CanonicalUserId ?? null;
+		} catch (err) {
+			this.logger.debug(`Could not resolve CloudFront OAI ${oaiId} canonical user id for bucket-policy drift normalization: ${err instanceof Error ? err.message : String(err)} — leaving the principal unchanged.`);
+			canonical = null;
+		}
+		oaiCanonicalUserIdCache.set(oaiId, canonical);
+		return canonical;
+	}
+	/**
 	* Adopt an existing S3 bucket policy into cdkd state.
 	*
 	* The operational identifier for an `S3::BucketPolicy` is the **bucket
@@ -18214,15 +18360,25 @@ var CloudFrontOAIProvider = class {
 //#endregion
 //#region src/provisioning/providers/cloudfront-distribution-provider.ts
 /**
-* Fields in the DistributionConfig that follow the { Quantity, Items } pattern.
-* The CDK template may provide just Items (an array); we wrap it with Quantity.
+* Top-level `DistributionConfig` fields that are a BARE ARRAY in the CFn
+* template but a `{ Quantity, Items }` wrapper in the SDK shape — so
+* `convertToSdkFormat` wraps them and `convertToCfnFormat` unwraps them.
+*
+* `OriginGroups` is deliberately NOT here (issue #873): unlike `Origins` /
+* `CacheBehaviors` / `Aliases` / `CustomErrorResponses` (bare lists in CFn), the
+* CFn `DistributionConfig.OriginGroups` property is ITSELF a `{ Quantity, Items }`
+* object, and so are its nested `Members` and `FailoverCriteria.StatusCodes`.
+* CDK synthesizes that full `{ Quantity, Items }` shape and `GetDistributionConfig`
+* returns the same, so OriginGroups must pass through UNTOUCHED in both
+* directions — unwrapping it (it was incorrectly listed here before) turned the
+* read-back OriginGroups into a bare array that no longer matched the template's
+* `{ Quantity, Items }`, firing phantom drift.
 */
 const QUANTITY_ITEM_FIELDS = [
 	"Origins",
 	"CacheBehaviors",
 	"CustomErrorResponses",
-	"Aliases",
-	"OriginGroups"
+	"Aliases"
 ];
 /**
 * Nested fields inside each CacheBehavior / DefaultCacheBehavior that use
@@ -18443,27 +18599,18 @@ var CloudFrontDistributionProvider = class {
 	*   logging bucket to its `<bucket>.s3.amazonaws.com` regional domain on
 	*   read, which never matches the bare bucket domain a template may
 	*   carry; treat it as drift-unknown to avoid a guaranteed mismatch.
-	* - `DistributionConfig.OriginGroups`: each origin group carries its own
-	*   inner `{ Quantity, Items }` wrappers (`Members`,
-	*   `FailoverCriteria.StatusCodes`) that `convertToCfnFormat` does not yet
-	*   unwrap symmetrically (only the top-level OriginGroups list is unwrapped;
-	*   there is no `revertOriginGroup` pass, and `convertToSdkFormat` likewise
-	*   does not descend into them). Against the observed baseline both sides go
-	*   through the same `readCurrentState` so this never false-positives on a
-	*   normal deploy, but against the `properties`-fallback baseline (older
-	*   state without `observedProperties`) the raw `{ Quantity, Items }` shape
-	*   would diff the bare-array template form. Suppress it until a dedicated
-	*   fix lands a `revertOriginGroup` + a real OriginGroups integ fixture
-	*   (there is no OriginGroups fixture to verify the inner shape today). See
-	*   the PR #871 review thread.
+	*
+	* NOTE: `DistributionConfig.OriginGroups` is NO LONGER suppressed (issue
+	* #873). The earlier suppression worked around `convertToCfnFormat`
+	* incorrectly unwrapping the top-level OriginGroups `{ Quantity, Items }`
+	* wrapper; the real fix (dropping OriginGroups from `QUANTITY_ITEM_FIELDS` so
+	* it passes through untouched in both directions) makes OriginGroups compare
+	* equal, so it is now drift-checked normally and a real OriginGroups change
+	* IS reported.
 	*/
 	getDriftUnknownPaths(resourceType) {
 		if (resourceType !== "AWS::CloudFront::Distribution") return [];
-		return [
-			"DistributionConfig.CallerReference",
-			"DistributionConfig.Logging.Bucket",
-			"DistributionConfig.OriginGroups"
-		];
+		return ["DistributionConfig.CallerReference", "DistributionConfig.Logging.Bucket"];
 	}
 	/**
 	* Get resource attribute (for Fn::GetAtt resolution)
@@ -38414,7 +38561,9 @@ function buildReadCurrentStateContext(state, excludedLogicalId) {
 		if (lid === excludedLogicalId) continue;
 		siblings[lid] = {
 			resourceType: res.resourceType,
-			properties: res.properties ?? {}
+			physicalId: res.physicalId,
+			properties: res.properties ?? {},
+			attributes: res.attributes ?? {}
 		};
 	}
 	return { siblings };
@@ -54379,7 +54528,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.223.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.223.2");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());