@go-to-k/cdkd 0.282.4 → 0.282.6

package/dist/{deploy-engine-CnxJLy3Y.js → deploy-engine-4K_iJ2rV.js}

@@ -2573,6 +2573,39 @@ const PARTITION_TABLE = [
 	}
 ];
 /**
+* Fold an AWS region name to its canonical lower-case spelling.
+*
+* AWS region ids ARE lower case — `${AWS::Region}` always returns that form —
+* but nothing between a `--region` flag and an SDK client enforces it, and
+* essentially everything downstream is case-SENSITIVE (issue
+* [#1795](https://github.com/go-to-k/cdkd/issues/1795)):
+*
+* - This module's own `PARTITION_TABLE` walk is a `startsWith` prefix test, so
+*   `--region CN-NORTH-1` fell through to the commercial partition and the
+*   `cdkd local *` commands synthesized
+*   `<acct>.dkr.ecr.CN-NORTH-1.amazonaws.com/...` — a `cn-` region carrying the
+*   commercial suffix, a host that does not exist.
+* - The AWS SDK's endpoint resolution is case-sensitive in the SAME direction.
+*   Measured against this repo's vendored `@aws-sdk/util-endpoints` partition
+*   data: `cn-north-1` resolves `aws-cn` / `amazonaws.com.cn` while
+*   `CN-NORTH-1` resolves `aws` / `amazonaws.com` (both the exact-match table
+*   and the `regionRegex` fallback are case-sensitive). So EVERY SDK client
+*   built from a raw region — `STSClient` for `${AWS::AccountId}`, the ECR /
+*   SecretsManager / SSM clients further down the `cdkd local` path — talks to
+*   the wrong partition's endpoint and fails.
+* - `${AWS::Region}` substituted from a raw value spells the region wrongly
+*   inside every ARN the resolver builds from it.
+*
+* Applied BOTH in `derivePartitionAndUrlSuffix` (so any caller of the mapping
+* inherits it) AND at the `cdkd local *` region-resolution points (so the
+* region VALUE those commands hand to SDK clients and to `${AWS::Region}` is
+* canonical too). Double-folding is a no-op, which is what makes having it in
+* both places safe rather than redundant.
+*/
+function canonicalizeRegion(region) {
+	return typeof region === "string" ? region.toLowerCase() : region;
+}
+/**
 * Derive the AWS partition / URL suffix for an AWS region. Same mapping
 * CloudFormation applies to `${AWS::Partition}` / `${AWS::URLSuffix}`.
 *
@@ -2583,9 +2616,24 @@ const PARTITION_TABLE = [
 * the COMMERCIAL suffix, so `parseEcrRegistryHost` (`src/utils/ecr-uri.ts`)
 * rejected it under the strict host check issue #1758 added and the image was
 * classified `public` — anonymous pull, no `docker login`, opaque failure.
+*
+* The region is CANONICALIZED through {@link canonicalizeRegion} before the
+* prefix tests (issue [#1795](https://github.com/go-to-k/cdkd/issues/1795)),
+* so every present and future caller inherits ONE normalization point and the
+* three `cdkd local *` call sites cannot drift apart again.
+*
+* This is only HALF the answer at those call sites, and the half it is NOT is
+* worth stating: canonicalizing here fixes the derived SUFFIX, but each caller
+* also passes the raw region VALUE to its SDK clients and stores it as
+* `${AWS::Region}`. The AWS SDK's own endpoint resolution is case-sensitive in
+* exactly the same way (measured against this repo's vendored
+* `@aws-sdk/util-endpoints` partition data: `CN-NORTH-1` resolves to the
+* COMMERCIAL `amazonaws.com`), so the callers canonicalize the value too — see
+* `canonicalizeRegion`'s own note.
 */
 function derivePartitionAndUrlSuffix(region) {
-	for (const { prefix, partition, urlSuffix } of PARTITION_TABLE) if (region.startsWith(prefix)) return {
+	const canonical = canonicalizeRegion(region);
+	for (const { prefix, partition, urlSuffix } of PARTITION_TABLE) if (canonical.startsWith(prefix)) return {
 		partition,
 		urlSuffix
 	};
@@ -4613,6 +4661,59 @@ var DockerAssetPublisher = class {
 	}
 };
 
+//#endregion
+//#region src/utils/deny-external-access-policy.ts
+/**
+* Build the `DenyExternalAccess` bucket policy cdkd applies to every bucket it
+* owns — the state bucket (`cdkd bootstrap`), the migration destination bucket
+* (`cdkd state-migrate`) and the asset bucket (`ensureAssetStorage`).
+*
+* The statement denies `s3:*` to every principal whose `aws:PrincipalAccount`
+* is not the bucket owner, so the resource ARNs it names are the whole
+* mechanism: a `Resource` that does not match the bucket makes the statement
+* apply to nothing, and the deny silently stops protecting anything.
+*
+* That is exactly what the hardcoded `arn:aws:` partition did outside the
+* commercial partition (issue
+* [#1794](https://github.com/go-to-k/cdkd/issues/1794), the residual of
+* [#1745](https://github.com/go-to-k/cdkd/issues/1745)). A bucket in `aws-cn`
+* is `arn:aws-cn:s3:::<bucket>`, so a statement naming `arn:aws:s3:::<bucket>`
+* matched no resource there. The policy was still structurally valid and
+* `PutBucketPolicy` still succeeded, which is what made the defect quiet —
+* cdkd reported "✓ Set bucket policy (deny external access)" over a bucket
+* that had no effective deny at all.
+*
+* The three call sites were byte-identical copies of this document before this
+* helper existed, and the partition literal drifted in all three at once. They
+* are centralized here so a fourth copy cannot re-introduce the same class:
+* the partition is derived from `region` in ONE place.
+*
+* @param bucketName - The bucket the policy is attached to.
+* @param accountId - The bucket owner; the only account the policy admits.
+* @param region - Any region in the BUCKET's partition; only the partition
+*   prefix is read, the region itself never appears in the output. Pass the
+*   region of the CLIENT that writes the bucket (`await
+*   client.config.region()`), NOT a CLI `--region` variable: those fall back to
+*   a hardcoded `us-east-1` when the flag is absent, while the client resolves
+*   the profile region through the SDK chain — so the two disagree exactly for
+*   the non-commercial user this helper exists to serve.
+* @returns The policy document, ready for `JSON.stringify`.
+*/
+function buildDenyExternalAccessPolicy(bucketName, accountId, region) {
+	const { partition } = derivePartitionAndUrlSuffix(region);
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Sid: "DenyExternalAccess",
+			Effect: "Deny",
+			Principal: "*",
+			Action: "s3:*",
+			Resource: [`arn:${partition}:s3:::${bucketName}`, `arn:${partition}:s3:::${bucketName}/*`],
+			Condition: { StringNotEquals: { "aws:PrincipalAccount": accountId } }
+		}]
+	};
+}
+
 //#endregion
 //#region src/assets/asset-storage.ts
 /**
@@ -4861,17 +4962,7 @@ async function ensureAssetStorage(options) {
 		await s3Client.send(new PutBucketPolicyCommand({
 			Bucket: assetBucket,
 			ExpectedBucketOwner: accountId,
-			Policy: JSON.stringify({
-				Version: "2012-10-17",
-				Statement: [{
-					Sid: "DenyExternalAccess",
-					Effect: "Deny",
-					Principal: "*",
-					Action: "s3:*",
-					Resource: [`arn:aws:s3:::${assetBucket}`, `arn:aws:s3:::${assetBucket}/*`],
-					Condition: { StringNotEquals: { "aws:PrincipalAccount": accountId } }
-				}]
-			})
+			Policy: JSON.stringify(buildDenyExternalAccessPolicy(assetBucket, accountId, await s3Client.config.region()))
 		}));
 		logger.info("✓ Configured asset bucket (AES-256 encryption, public access block, deny external access)");
 	}
@@ -13754,7 +13845,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-D9VJTwn3.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Dm_dVhvQ.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -20671,7 +20762,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.282.4";
+	return "0.282.6";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -22839,5 +22930,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { configStringRefusal as $, resolveUseCdkBootstrapAssets as $t, green as A, ProvisioningError as An, BOOTSTRAP_MARKER_PREFIX as At, slowCcOperationTimeoutMs as B, withErrorHandling as Bn, runDockerStreaming as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, LocalInvokeBuildError as Cn, stringifyValue as Ct, bold as D, MissingCdkCliError as Dn, loadPublishableAssetManifest as Dt, formatResourceLine as E, LockError as En, createAssetRedirectResolver as Et, clearOnUpdateRemoval as F, StateError as Fn, validateContainerRepoName as Ft, getAccountInfo as G, getDefaultStateBucketName as Gt, isTerminationProtectionPropagationError as H, getDockerImageBySourceHash as Ht, ProviderRegistry as I, SynthesisError as In, buildDockerImage as It, normalizeAwsTagsToCfn as J, resolveAutoAssetStorage as Jt, refStateLookupFromResource as K, getLegacyStateBucketName as Kt, findActionableSilentDrops as L, formatError as Ln, formatDockerLoginError as Lt, yellow as M, ResourceUpdateNotSupportedError as Mn, getBootstrapMarkerKey as Mt, IAMRoleProvider as N, StackHasActiveImportsError as Nn, parseBootstrapMarker as Nt, cyan as O, NestedStackChildDirectDestroyError as On, rewriteTemplateAssetReferences as Ot, collectInlinePolicyNamesManagedBySiblings as P, StackTerminationProtectionError as Pn, validateAssetBucketName as Pt, configBooleanRefusal as Q, resolveStateBucketWithDefaultAndSource as Qt, findSilentDropProperties as R, isCdkdError as Rn, getDockerCmd as Rt, extractDeploymentEventError as S, DeployCancelledError as Sn, AssetPublisher as St, renderStatefulReason as T, LocalStartServiceError as Tn, buildAssetRedirectMap as Tt, IntrinsicFunctionResolver as U, Synthesizer as Ut, disableInstanceApiTermination as V, __exportAll as Vn, AssetManifestLoader as Vt, cfnRefValueFromPhysicalId as W, synthesisStatusMessage as Wt, assertRegionMatch as X, resolveSkipPrefix as Xt, resolveExplicitPhysicalId as Y, resolveCaptureObservedState as Yt, coerceCfnBoolean as Z, resolveStateBucketWithDefault as Zt, createPreDeleteFinalSnapshot as _, setAwsClients as _n, TemplateParser as _t, DeploymentEventsStore as a, findLargeInlineResources as an, s3BucketArn as at, unsupportedFinalSnapshotError as b, ConfigError as bn, rebuildClientForBucketRegion as bt, replayFailedOperations as c, PARTITION_TABLE as cn, s3BucketRegionalDomainName as ct, IMPLICIT_DELETE_DEPENDENCIES as d, processStackMessages as dn, DiffCalculator as dt, stateBucketExistenceConfirmed as en, readConfigString as et, computeImplicitDeleteEdges as f, clearBucketRegionCache as fn, describeTypeWithThrottleRetry as ft, ccRoutedFinalSnapshotError as g, resetAwsClients as gn, DagBuilder as gt, buildFinalSnapshotIdentifier as h, getAwsClients as hn, isThrottlingError as ht, DeploymentEventsReader as i, MIGRATE_TMP_PREFIX as in, requireConfigString as it, red as j, ResourceTimeoutError as jn, ensureAssetStorage as jt, gray as k, PartialFailureError as kn, AssetModeResolver as kt, replayRollback as l, derivePartitionAndUrlSuffix as ln, s3BucketWebsiteUrl as lt, PRE_DELETE_SNAPSHOT_TYPES as m, AwsClients as mn, isRetryableTransientError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CFN_TEMPLATE_BODY_LIMIT as nn, requireConfigArray as nt, planFailedOps as o, uploadCfnTemplate as on, s3BucketDomainName as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, resolveBucketRegion as pn, withRetry as pt, WAFv2WebACLProvider as q, resolveApp as qt, DeployEngine as r, CFN_TEMPLATE_URL_LIMIT as rn, requireConfigObject as rt, planRollback as s, expectedOwnerParam as sn, s3BucketDualStackDomainName as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, warnDeprecatedNoPrefixCliFlag as tn, replayWarn as tt, withResourceDeadline as u, AssemblyReader as un, applyRoleArnIfSet as ut, isFinalSnapshotError as v, AssetError as vn, LockManager as vt, isStatefulRecreateTargetSync as w, LocalMigrateError as wn, WorkGraph as wt, makeCanonicalizePropertiesFn as x, DependencyError as xn, shouldRetainResource as xt, refusesFinalSnapshot as y, CdkdError as yn, S3StateBackend as yt, CloudControlProvider as z, normalizeAwsError as zn, runDockerForeground as zt };
-//# sourceMappingURL=deploy-engine-CnxJLy3Y.js.map
+export { configStringRefusal as $, resolveStateBucketWithDefaultAndSource as $t, green as A, NestedStackChildDirectDestroyError as An, BOOTSTRAP_MARKER_PREFIX as At, slowCcOperationTimeoutMs as B, isCdkdError as Bn, runDockerForeground as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, DependencyError as Cn, stringifyValue as Ct, bold as D, LocalStartServiceError as Dn, loadPublishableAssetManifest as Dt, formatResourceLine as E, LocalMigrateError as En, createAssetRedirectResolver as Et, clearOnUpdateRemoval as F, StackHasActiveImportsError as Fn, validateContainerRepoName as Ft, getAccountInfo as G, synthesisStatusMessage as Gt, isTerminationProtectionPropagationError as H, withErrorHandling as Hn, AssetManifestLoader as Ht, ProviderRegistry as I, StackTerminationProtectionError as In, buildDenyExternalAccessPolicy as It, normalizeAwsTagsToCfn as J, resolveApp as Jt, refStateLookupFromResource as K, getDefaultStateBucketName as Kt, findActionableSilentDrops as L, StateError as Ln, buildDockerImage as Lt, yellow as M, ProvisioningError as Mn, getBootstrapMarkerKey as Mt, IAMRoleProvider as N, ResourceTimeoutError as Nn, parseBootstrapMarker as Nt, cyan as O, LockError as On, rewriteTemplateAssetReferences as Ot, collectInlinePolicyNamesManagedBySiblings as P, ResourceUpdateNotSupportedError as Pn, validateAssetBucketName as Pt, configBooleanRefusal as Q, resolveStateBucketWithDefault as Qt, findSilentDropProperties as R, SynthesisError as Rn, formatDockerLoginError as Rt, extractDeploymentEventError as S, ConfigError as Sn, AssetPublisher as St, renderStatefulReason as T, LocalInvokeBuildError as Tn, buildAssetRedirectMap as Tt, IntrinsicFunctionResolver as U, __exportAll as Un, getDockerImageBySourceHash as Ut, disableInstanceApiTermination as V, normalizeAwsError as Vn, runDockerStreaming as Vt, cfnRefValueFromPhysicalId as W, Synthesizer as Wt, assertRegionMatch as X, resolveCaptureObservedState as Xt, resolveExplicitPhysicalId as Y, resolveAutoAssetStorage as Yt, coerceCfnBoolean as Z, resolveSkipPrefix as Zt, createPreDeleteFinalSnapshot as _, getAwsClients as _n, TemplateParser as _t, DeploymentEventsStore as a, MIGRATE_TMP_PREFIX as an, s3BucketArn as at, unsupportedFinalSnapshotError as b, AssetError as bn, rebuildClientForBucketRegion as bt, replayFailedOperations as c, expectedOwnerParam as cn, s3BucketRegionalDomainName as ct, IMPLICIT_DELETE_DEPENDENCIES as d, derivePartitionAndUrlSuffix as dn, DiffCalculator as dt, resolveUseCdkBootstrapAssets as en, readConfigString as et, computeImplicitDeleteEdges as f, AssemblyReader as fn, describeTypeWithThrottleRetry as ft, ccRoutedFinalSnapshotError as g, AwsClients as gn, DagBuilder as gt, buildFinalSnapshotIdentifier as h, resolveBucketRegion as hn, isThrottlingError as ht, DeploymentEventsReader as i, CFN_TEMPLATE_URL_LIMIT as in, requireConfigString as it, red as j, PartialFailureError as jn, ensureAssetStorage as jt, gray as k, MissingCdkCliError as kn, AssetModeResolver as kt, replayRollback as l, PARTITION_TABLE as ln, s3BucketWebsiteUrl as lt, PRE_DELETE_SNAPSHOT_TYPES as m, clearBucketRegionCache as mn, isRetryableTransientError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, warnDeprecatedNoPrefixCliFlag as nn, requireConfigArray as nt, planFailedOps as o, findLargeInlineResources as on, s3BucketDomainName as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, processStackMessages as pn, withRetry as pt, WAFv2WebACLProvider as q, getLegacyStateBucketName as qt, DeployEngine as r, CFN_TEMPLATE_BODY_LIMIT as rn, requireConfigObject as rt, planRollback as s, uploadCfnTemplate as sn, s3BucketDualStackDomainName as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, stateBucketExistenceConfirmed as tn, replayWarn as tt, withResourceDeadline as u, canonicalizeRegion as un, applyRoleArnIfSet as ut, isFinalSnapshotError as v, resetAwsClients as vn, LockManager as vt, isStatefulRecreateTargetSync as w, DeployCancelledError as wn, WorkGraph as wt, makeCanonicalizePropertiesFn as x, CdkdError as xn, shouldRetainResource as xt, refusesFinalSnapshot as y, setAwsClients as yn, S3StateBackend as yt, CloudControlProvider as z, formatError as zn, getDockerCmd as zt };
+//# sourceMappingURL=deploy-engine-4K_iJ2rV.js.map