@go-to-k/cdkd 0.282.5 → 0.282.7

package/dist/{deploy-engine-Cg_wFdJP.js → deploy-engine-NA36xDvk.js}

@@ -4661,6 +4661,59 @@ var DockerAssetPublisher = class {
 	}
 };
 
+//#endregion
+//#region src/utils/deny-external-access-policy.ts
+/**
+* Build the `DenyExternalAccess` bucket policy cdkd applies to every bucket it
+* owns — the state bucket (`cdkd bootstrap`), the migration destination bucket
+* (`cdkd state-migrate`) and the asset bucket (`ensureAssetStorage`).
+*
+* The statement denies `s3:*` to every principal whose `aws:PrincipalAccount`
+* is not the bucket owner, so the resource ARNs it names are the whole
+* mechanism: a `Resource` that does not match the bucket makes the statement
+* apply to nothing, and the deny silently stops protecting anything.
+*
+* That is exactly what the hardcoded `arn:aws:` partition did outside the
+* commercial partition (issue
+* [#1794](https://github.com/go-to-k/cdkd/issues/1794), the residual of
+* [#1745](https://github.com/go-to-k/cdkd/issues/1745)). A bucket in `aws-cn`
+* is `arn:aws-cn:s3:::<bucket>`, so a statement naming `arn:aws:s3:::<bucket>`
+* matched no resource there. The policy was still structurally valid and
+* `PutBucketPolicy` still succeeded, which is what made the defect quiet —
+* cdkd reported "✓ Set bucket policy (deny external access)" over a bucket
+* that had no effective deny at all.
+*
+* The three call sites were byte-identical copies of this document before this
+* helper existed, and the partition literal drifted in all three at once. They
+* are centralized here so a fourth copy cannot re-introduce the same class:
+* the partition is derived from `region` in ONE place.
+*
+* @param bucketName - The bucket the policy is attached to.
+* @param accountId - The bucket owner; the only account the policy admits.
+* @param region - Any region in the BUCKET's partition; only the partition
+*   prefix is read, the region itself never appears in the output. Pass the
+*   region of the CLIENT that writes the bucket (`await
+*   client.config.region()`), NOT a CLI `--region` variable: those fall back to
+*   a hardcoded `us-east-1` when the flag is absent, while the client resolves
+*   the profile region through the SDK chain — so the two disagree exactly for
+*   the non-commercial user this helper exists to serve.
+* @returns The policy document, ready for `JSON.stringify`.
+*/
+function buildDenyExternalAccessPolicy(bucketName, accountId, region) {
+	const { partition } = derivePartitionAndUrlSuffix(region);
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Sid: "DenyExternalAccess",
+			Effect: "Deny",
+			Principal: "*",
+			Action: "s3:*",
+			Resource: [`arn:${partition}:s3:::${bucketName}`, `arn:${partition}:s3:::${bucketName}/*`],
+			Condition: { StringNotEquals: { "aws:PrincipalAccount": accountId } }
+		}]
+	};
+}
+
 //#endregion
 //#region src/assets/asset-storage.ts
 /**
@@ -4909,17 +4962,7 @@ async function ensureAssetStorage(options) {
 		await s3Client.send(new PutBucketPolicyCommand({
 			Bucket: assetBucket,
 			ExpectedBucketOwner: accountId,
-			Policy: JSON.stringify({
-				Version: "2012-10-17",
-				Statement: [{
-					Sid: "DenyExternalAccess",
-					Effect: "Deny",
-					Principal: "*",
-					Action: "s3:*",
-					Resource: [`arn:aws:s3:::${assetBucket}`, `arn:aws:s3:::${assetBucket}/*`],
-					Condition: { StringNotEquals: { "aws:PrincipalAccount": accountId } }
-				}]
-			})
+			Policy: JSON.stringify(buildDenyExternalAccessPolicy(assetBucket, accountId, await s3Client.config.region()))
 		}));
 		logger.info("✓ Configured asset bucket (AES-256 encryption, public access block, deny external access)");
 	}
@@ -13802,7 +13845,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Dl8-YYQR.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DulIbRCK.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -20719,7 +20762,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.282.5";
+	return "0.282.7";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -22887,5 +22930,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { configStringRefusal as $, resolveUseCdkBootstrapAssets as $t, green as A, PartialFailureError as An, BOOTSTRAP_MARKER_PREFIX as At, slowCcOperationTimeoutMs as B, normalizeAwsError as Bn, runDockerStreaming as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, DeployCancelledError as Cn, stringifyValue as Ct, bold as D, LockError as Dn, loadPublishableAssetManifest as Dt, formatResourceLine as E, LocalStartServiceError as En, createAssetRedirectResolver as Et, clearOnUpdateRemoval as F, StackTerminationProtectionError as Fn, validateContainerRepoName as Ft, getAccountInfo as G, getDefaultStateBucketName as Gt, isTerminationProtectionPropagationError as H, __exportAll as Hn, getDockerImageBySourceHash as Ht, ProviderRegistry as I, StateError as In, buildDockerImage as It, normalizeAwsTagsToCfn as J, resolveAutoAssetStorage as Jt, refStateLookupFromResource as K, getLegacyStateBucketName as Kt, findActionableSilentDrops as L, SynthesisError as Ln, formatDockerLoginError as Lt, yellow as M, ResourceTimeoutError as Mn, getBootstrapMarkerKey as Mt, IAMRoleProvider as N, ResourceUpdateNotSupportedError as Nn, parseBootstrapMarker as Nt, cyan as O, MissingCdkCliError as On, rewriteTemplateAssetReferences as Ot, collectInlinePolicyNamesManagedBySiblings as P, StackHasActiveImportsError as Pn, validateAssetBucketName as Pt, configBooleanRefusal as Q, resolveStateBucketWithDefaultAndSource as Qt, findSilentDropProperties as R, formatError as Rn, getDockerCmd as Rt, extractDeploymentEventError as S, DependencyError as Sn, AssetPublisher as St, renderStatefulReason as T, LocalMigrateError as Tn, buildAssetRedirectMap as Tt, IntrinsicFunctionResolver as U, Synthesizer as Ut, disableInstanceApiTermination as V, withErrorHandling as Vn, AssetManifestLoader as Vt, cfnRefValueFromPhysicalId as W, synthesisStatusMessage as Wt, assertRegionMatch as X, resolveSkipPrefix as Xt, resolveExplicitPhysicalId as Y, resolveCaptureObservedState as Yt, coerceCfnBoolean as Z, resolveStateBucketWithDefault as Zt, createPreDeleteFinalSnapshot as _, resetAwsClients as _n, TemplateParser as _t, DeploymentEventsStore as a, findLargeInlineResources as an, s3BucketArn as at, unsupportedFinalSnapshotError as b, CdkdError as bn, rebuildClientForBucketRegion as bt, replayFailedOperations as c, PARTITION_TABLE as cn, s3BucketRegionalDomainName as ct, IMPLICIT_DELETE_DEPENDENCIES as d, AssemblyReader as dn, DiffCalculator as dt, stateBucketExistenceConfirmed as en, readConfigString as et, computeImplicitDeleteEdges as f, processStackMessages as fn, describeTypeWithThrottleRetry as ft, ccRoutedFinalSnapshotError as g, getAwsClients as gn, DagBuilder as gt, buildFinalSnapshotIdentifier as h, AwsClients as hn, isThrottlingError as ht, DeploymentEventsReader as i, MIGRATE_TMP_PREFIX as in, requireConfigString as it, red as j, ProvisioningError as jn, ensureAssetStorage as jt, gray as k, NestedStackChildDirectDestroyError as kn, AssetModeResolver as kt, replayRollback as l, canonicalizeRegion as ln, s3BucketWebsiteUrl as lt, PRE_DELETE_SNAPSHOT_TYPES as m, resolveBucketRegion as mn, isRetryableTransientError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CFN_TEMPLATE_BODY_LIMIT as nn, requireConfigArray as nt, planFailedOps as o, uploadCfnTemplate as on, s3BucketDomainName as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, clearBucketRegionCache as pn, withRetry as pt, WAFv2WebACLProvider as q, resolveApp as qt, DeployEngine as r, CFN_TEMPLATE_URL_LIMIT as rn, requireConfigObject as rt, planRollback as s, expectedOwnerParam as sn, s3BucketDualStackDomainName as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, warnDeprecatedNoPrefixCliFlag as tn, replayWarn as tt, withResourceDeadline as u, derivePartitionAndUrlSuffix as un, applyRoleArnIfSet as ut, isFinalSnapshotError as v, setAwsClients as vn, LockManager as vt, isStatefulRecreateTargetSync as w, LocalInvokeBuildError as wn, WorkGraph as wt, makeCanonicalizePropertiesFn as x, ConfigError as xn, shouldRetainResource as xt, refusesFinalSnapshot as y, AssetError as yn, S3StateBackend as yt, CloudControlProvider as z, isCdkdError as zn, runDockerForeground as zt };
-//# sourceMappingURL=deploy-engine-Cg_wFdJP.js.map
+export { configStringRefusal as $, resolveStateBucketWithDefaultAndSource as $t, green as A, NestedStackChildDirectDestroyError as An, BOOTSTRAP_MARKER_PREFIX as At, slowCcOperationTimeoutMs as B, isCdkdError as Bn, runDockerForeground as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, DependencyError as Cn, stringifyValue as Ct, bold as D, LocalStartServiceError as Dn, loadPublishableAssetManifest as Dt, formatResourceLine as E, LocalMigrateError as En, createAssetRedirectResolver as Et, clearOnUpdateRemoval as F, StackHasActiveImportsError as Fn, validateContainerRepoName as Ft, getAccountInfo as G, synthesisStatusMessage as Gt, isTerminationProtectionPropagationError as H, withErrorHandling as Hn, AssetManifestLoader as Ht, ProviderRegistry as I, StackTerminationProtectionError as In, buildDenyExternalAccessPolicy as It, normalizeAwsTagsToCfn as J, resolveApp as Jt, refStateLookupFromResource as K, getDefaultStateBucketName as Kt, findActionableSilentDrops as L, StateError as Ln, buildDockerImage as Lt, yellow as M, ProvisioningError as Mn, getBootstrapMarkerKey as Mt, IAMRoleProvider as N, ResourceTimeoutError as Nn, parseBootstrapMarker as Nt, cyan as O, LockError as On, rewriteTemplateAssetReferences as Ot, collectInlinePolicyNamesManagedBySiblings as P, ResourceUpdateNotSupportedError as Pn, validateAssetBucketName as Pt, configBooleanRefusal as Q, resolveStateBucketWithDefault as Qt, findSilentDropProperties as R, SynthesisError as Rn, formatDockerLoginError as Rt, extractDeploymentEventError as S, ConfigError as Sn, AssetPublisher as St, renderStatefulReason as T, LocalInvokeBuildError as Tn, buildAssetRedirectMap as Tt, IntrinsicFunctionResolver as U, __exportAll as Un, getDockerImageBySourceHash as Ut, disableInstanceApiTermination as V, normalizeAwsError as Vn, runDockerStreaming as Vt, cfnRefValueFromPhysicalId as W, Synthesizer as Wt, assertRegionMatch as X, resolveCaptureObservedState as Xt, resolveExplicitPhysicalId as Y, resolveAutoAssetStorage as Yt, coerceCfnBoolean as Z, resolveSkipPrefix as Zt, createPreDeleteFinalSnapshot as _, getAwsClients as _n, TemplateParser as _t, DeploymentEventsStore as a, MIGRATE_TMP_PREFIX as an, s3BucketArn as at, unsupportedFinalSnapshotError as b, AssetError as bn, rebuildClientForBucketRegion as bt, replayFailedOperations as c, expectedOwnerParam as cn, s3BucketRegionalDomainName as ct, IMPLICIT_DELETE_DEPENDENCIES as d, derivePartitionAndUrlSuffix as dn, DiffCalculator as dt, resolveUseCdkBootstrapAssets as en, readConfigString as et, computeImplicitDeleteEdges as f, AssemblyReader as fn, describeTypeWithThrottleRetry as ft, ccRoutedFinalSnapshotError as g, AwsClients as gn, DagBuilder as gt, buildFinalSnapshotIdentifier as h, resolveBucketRegion as hn, isThrottlingError as ht, DeploymentEventsReader as i, CFN_TEMPLATE_URL_LIMIT as in, requireConfigString as it, red as j, PartialFailureError as jn, ensureAssetStorage as jt, gray as k, MissingCdkCliError as kn, AssetModeResolver as kt, replayRollback as l, PARTITION_TABLE as ln, s3BucketWebsiteUrl as lt, PRE_DELETE_SNAPSHOT_TYPES as m, clearBucketRegionCache as mn, isRetryableTransientError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, warnDeprecatedNoPrefixCliFlag as nn, requireConfigArray as nt, planFailedOps as o, findLargeInlineResources as on, s3BucketDomainName as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, processStackMessages as pn, withRetry as pt, WAFv2WebACLProvider as q, getLegacyStateBucketName as qt, DeployEngine as r, CFN_TEMPLATE_BODY_LIMIT as rn, requireConfigObject as rt, planRollback as s, uploadCfnTemplate as sn, s3BucketDualStackDomainName as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, stateBucketExistenceConfirmed as tn, replayWarn as tt, withResourceDeadline as u, canonicalizeRegion as un, applyRoleArnIfSet as ut, isFinalSnapshotError as v, resetAwsClients as vn, LockManager as vt, isStatefulRecreateTargetSync as w, DeployCancelledError as wn, WorkGraph as wt, makeCanonicalizePropertiesFn as x, CdkdError as xn, shouldRetainResource as xt, refusesFinalSnapshot as y, setAwsClients as yn, S3StateBackend as yt, CloudControlProvider as z, formatError as zn, getDockerCmd as zt };
+//# sourceMappingURL=deploy-engine-NA36xDvk.js.map