@gradientedge/cdk-utils-aws 2.17.0 → 2.18.0

package/dist/src/construct/api-to-eventbridge-target/main.js

@@ -156,7 +156,7 @@ export class ApiToEventBridgeTarget extends CommonConstruct {
      */
     createApiToEventBridgeTargetPolicy() {
         this.apiToEventBridgeTargetRestApi.policy = new PolicyDocument({
-            statements: [this.iamManager.statementForPutEvents()],
+            statements: [this.iamManager.statementForPutEvents([this.apiEvent.eventBus.eventBusArn])],
         });
     }
     /**

package/dist/src/construct/api-to-lambda-target/main.js

@@ -177,7 +177,10 @@ export class ApiToLambdaTarget extends CommonConstruct {
     createApiToLambdaTargetPolicy() {
         this.apiToLambdaTargetRestApi.policy = new PolicyDocument({
             statements: [
-                this.iamManager.statementForPutEvents(),
+                /* PutEvents kept wildcard - api-to-lambda-target may publish to any bus the
+                   consumer wires through Lambda destinations; the consumer should override
+                   if a specific bus ARN can be supplied */
+                this.iamManager.statementForPutEvents(['*']),
                 this.iamManager.statementForInvokeLambda([this.apiToLambdaTargetRestApi.lambda.functionArn]),
             ],
         });

package/dist/src/construct/lambda-with-iam-access/main.js

@@ -115,10 +115,21 @@ export class LambdaWithIamAccess extends CommonConstruct {
      */
     createLambdaPolicy() {
         this.lambdaPolicy = new PolicyDocument({
-            statements: [this.iamManager.statementForCreateAnyLogStream(), this.iamManager.statementForPutXrayTelemetry()],
+            statements: [
+                /* CloudWatch Logs stream creation - the function's own log group is
+                   granted via AWSLambdaBasicExecutionRole; this wildcard covers
+                   caller-supplied groups, override via subclass if scoping is needed */
+                this.iamManager.statementForCreateAnyLogStream(['*']),
+                /* xray:PutTraceSegments / xray:PutTelemetryRecords do not support
+                   resource-level IAM per AWS docs - must be Resource:* */
+                this.iamManager.statementForPutXrayTelemetry(['*']),
+            ],
         });
         if (this.props.configEnabled) {
-            this.lambdaPolicy.addStatements(this.iamManager.statementForReadAnyAppConfig(), this.iamManager.statementForAppConfigExecution());
+            this.lambdaPolicy.addStatements(
+            /* AppConfig grants - scoping requires the consumer's application/environment
+               ARN; left wildcard by default, override via subclass if known */
+            this.iamManager.statementForReadAnyAppConfig(['*']), this.iamManager.statementForAppConfigExecution(['*']));
         }
     }
     /**

package/dist/src/construct/rest-api-lambda/main.js

@@ -108,7 +108,9 @@ export class RestApiLambda extends CommonConstruct {
      */
     createLambdaPolicy() {
         this.restApiLambdaPolicy = new PolicyDocument({
-            statements: [this.iamManager.statementForCreateAnyLogStream()],
+            /* the function's own log group is already covered by AWSLambdaBasicExecutionRole;
+               wildcard here preserves prior behaviour for caller-supplied log groups */
+            statements: [this.iamManager.statementForCreateAnyLogStream(['*'])],
         });
     }
     /**

package/dist/src/construct/rest-api-lambda-with-cache/main.js

@@ -1,5 +1,5 @@
 import { Fn } from 'aws-cdk-lib';
-import { Peer, Port, SecurityGroup } from 'aws-cdk-lib/aws-ec2';
+import { Port, SecurityGroup } from 'aws-cdk-lib/aws-ec2';
 import { ManagedPolicy } from 'aws-cdk-lib/aws-iam';
 import _ from 'lodash';
 import { createCfnOutput } from '../../utils/index.js';
@@ -74,16 +74,24 @@ export class RestApiLambdaWithCache extends RestApiLambda {
             this.restApiSecurityGroup = SecurityGroup.fromSecurityGroupId(this, `${this.id}-security-group`, Fn.importValue(this.props.securityGroupExportName));
         }
         else {
-            this.restApiSecurityGroup = new SecurityGroup(this, `${this.id}-security-group-${this.props.stage}`, {
+            const securityGroup = new SecurityGroup(this, `${this.id}-security-group-${this.props.stage}`, {
                 securityGroupName: `${this.id}-security-group-${this.props.stage}`,
                 vpc: this.restApivpc,
             });
-            if (this.props.restApiVpc.isIPV6) {
-                this.restApiSecurityGroup.addIngressRule(Peer.anyIpv6(), Port.allTraffic(), 'All Traffic');
-            }
-            else {
-                this.restApiSecurityGroup.addIngressRule(Peer.anyIpv4(), Port.allTraffic(), 'All Traffic');
+            const ingressRules = this.props.securityGroupIngressRules ??
+                (this.props.restApiCache
+                    ? [
+                        {
+                            description: 'Lambda to ElastiCache',
+                            peer: securityGroup,
+                            port: Port.tcp(this.props.restApiCache.port ?? 6379),
+                        },
+                    ]
+                    : []);
+            for (const rule of ingressRules) {
+                securityGroup.addIngressRule(rule.peer, rule.port, rule.description);
             }
+            this.restApiSecurityGroup = securityGroup;
             createCfnOutput(`${this.id}-security-group-id`, this, this.restApiSecurityGroup.securityGroupId);
         }
     }

package/dist/src/construct/rest-api-lambda-with-cache/types.d.ts

@@ -1,5 +1,18 @@
+import { IPeer, Port } from 'aws-cdk-lib/aws-ec2';
 import { RestApiLambdaProps } from '../rest-api-lambda/index.js';
 import { ReplicatedElastiCacheProps, VpcProps } from '../../services/index.js';
+/**
+ * An ingress rule for the security group created by {@link RestApiLambdaWithCache}
+ */
+/** @category Interface */
+export interface RestApiLambdaWithCacheIngressRuleProps {
+    /** The peer to allow ingress from */
+    peer: IPeer;
+    /** The port range to allow ingress on */
+    port: Port;
+    /** Optional description for the rule */
+    description?: string;
+}
 /**
  * Properties for configuring a {@link RestApiLambdaWithCache} construct
  */
@@ -11,6 +24,13 @@ export interface RestApiLambdaWithCacheProps extends RestApiLambdaProps {
     restApiVpc: VpcProps;
     /** CloudFormation export name for an existing security group */
     securityGroupExportName: string;
+    /**
+     * Ingress rules for the security group created when securityGroupExportName is not set.
+     * Defaults to a single self-referencing rule allowing the Lambda function to reach the
+     * ElastiCache cluster on its configured port (6379 if unset). No ingress is added when
+     * no cache is configured.
+     */
+    securityGroupIngressRules?: RestApiLambdaWithCacheIngressRuleProps[];
     /** Whether to look up an existing VPC instead of creating one */
     useExistingVpc: boolean;
     /** Name of an existing VPC to look up */

package/dist/src/construct/site-with-ecs-backend/main.js

@@ -196,7 +196,9 @@ export class SiteWithEcsBackend extends CommonConstruct {
      */
     createEcsPolicy() {
         this.siteEcsPolicy = new PolicyDocument({
-            statements: [this.iamManager.statementForCreateAnyLogStream()],
+            /* covered by AmazonECSTaskExecutionRolePolicy managed policy for the task's
+               own log group; wildcard preserves prior behaviour for additional groups */
+            statements: [this.iamManager.statementForCreateAnyLogStream(['*'])],
         });
     }
     /**

package/dist/src/construct/site-with-lambda-backend/main.d.ts

@@ -1,6 +1,5 @@
 import { ICertificate } from 'aws-cdk-lib/aws-certificatemanager';
-import { CachePolicy, IFunction as CfIFunction, Distribution, FunctionAssociation, OriginRequestPolicy, ResponseHeadersPolicy } from 'aws-cdk-lib/aws-cloudfront';
-import { HttpOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
+import { CachePolicy, IFunction as CfIFunction, Distribution, FunctionAssociation, IOrigin, OriginRequestPolicy, ResponseHeadersPolicy } from 'aws-cdk-lib/aws-cloudfront';
 import { PolicyDocument, Role } from 'aws-cdk-lib/aws-iam';
 import { AssetCode, FunctionUrl, IFunction, ILayerVersion } from 'aws-cdk-lib/aws-lambda';
 import { IHostedZone } from 'aws-cdk-lib/aws-route53';
@@ -40,8 +39,8 @@ export declare class SiteWithLambdaBackend extends CommonConstruct {
     siteSecrets: any;
     /** The S3 bucket used for CloudFront access logs */
     siteLogBucket: IBucket;
-    /** The HTTP origin backed by the Lambda function URL */
-    siteOrigin: HttpOrigin;
+    /** The CloudFront origin backed by the Lambda function URL */
+    siteOrigin: IOrigin;
     /** The CloudFront distribution for the site */
     siteDistribution: Distribution;
     /** The internal domain name used for Lambda function URL routing */
@@ -152,7 +151,11 @@ export declare class SiteWithLambdaBackend extends CommonConstruct {
      */
     protected createSiteStaticAssetDeployment(): void;
     /**
-     * @summary Create the IAM policy for the site Lambda function
+     * @summary Create the IAM policy for the site Lambda function.
+     * Defaults to an empty document — CloudWatch Logs access is supplied by
+     * `AWSLambdaBasicExecutionRole` which `createRoleForLambda` attaches separately.
+     * Consumers granting the Lambda access to specific resources should set
+     * `siteLambdaAdditionalPolicyStatements` rather than override this method.
      */
     protected createSiteLambdaPolicy(): void;
     /**

package/dist/src/construct/site-with-lambda-backend/main.js

@@ -1,6 +1,6 @@
 import { Duration, Fn } from 'aws-cdk-lib';
 import { CachePolicy, FunctionEventType, OriginProtocolPolicy, OriginRequestPolicy, ResponseHeadersPolicy, } from 'aws-cdk-lib/aws-cloudfront';
-import { HttpOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
+import { FunctionUrlOrigin, HttpOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
 import { AnyPrincipal, Effect, PolicyDocument, PolicyStatement } from 'aws-cdk-lib/aws-iam';
 import { Function, FunctionUrlAuthType } from 'aws-cdk-lib/aws-lambda';
 import _ from 'lodash';
@@ -37,7 +37,7 @@ export class SiteWithLambdaBackend extends CommonConstruct {
     siteSecrets;
     /** The S3 bucket used for CloudFront access logs */
     siteLogBucket;
-    /** The HTTP origin backed by the Lambda function URL */
+    /** The CloudFront origin backed by the Lambda function URL */
     siteOrigin;
     /** The CloudFront distribution for the site */
     siteDistribution;
@@ -253,11 +253,21 @@ export class SiteWithLambdaBackend extends CommonConstruct {
      */
     createSiteOrigin() {
         this.createSiteOriginResources();
-        this.siteOrigin = new HttpOrigin(Fn.select(2, Fn.split('/', this.siteLambdaUrl.url)), {
-            httpPort: 443,
-            originId: `${this.id}-server`,
-            protocolPolicy: OriginProtocolPolicy.HTTPS_ONLY,
-        });
+        const authType = this.props.siteLambdaUrlAuthType ?? FunctionUrlAuthType.AWS_IAM;
+        if (authType === FunctionUrlAuthType.AWS_IAM) {
+            /* CloudFront signs requests to the Function URL via an automatically-provisioned
+               Origin Access Control. The OAC also attaches a scoped lambda:InvokeFunctionUrl
+               resource policy permitting only cloudfront.amazonaws.com sourced from this
+               distribution ARN. */
+            this.siteOrigin = FunctionUrlOrigin.withOriginAccessControl(this.siteLambdaUrl);
+        }
+        else {
+            this.siteOrigin = new HttpOrigin(Fn.select(2, Fn.split('/', this.siteLambdaUrl.url)), {
+                httpPort: 443,
+                originId: `${this.id}-server`,
+                protocolPolicy: OriginProtocolPolicy.HTTPS_ONLY,
+            });
+        }
     }
     /**
      * @summary Orchestrate creation of all Lambda-based origin resources
@@ -277,17 +287,15 @@ export class SiteWithLambdaBackend extends CommonConstruct {
      */
     createSiteStaticAssetDeployment() { }
     /**
-     * @summary Create the IAM policy for the site Lambda function
+     * @summary Create the IAM policy for the site Lambda function.
+     * Defaults to an empty document — CloudWatch Logs access is supplied by
+     * `AWSLambdaBasicExecutionRole` which `createRoleForLambda` attaches separately.
+     * Consumers granting the Lambda access to specific resources should set
+     * `siteLambdaAdditionalPolicyStatements` rather than override this method.
      */
     createSiteLambdaPolicy() {
         this.siteLambdaPolicy = new PolicyDocument({
-            statements: [
-                new PolicyStatement({
-                    actions: ['lambda:InvokeFunctionUrl'],
-                    effect: Effect.ALLOW,
-                    resources: ['*'],
-                }),
-            ],
+            statements: [...(this.props.siteLambdaAdditionalPolicyStatements ?? [])],
         });
     }
     /**
@@ -343,22 +351,32 @@ export class SiteWithLambdaBackend extends CommonConstruct {
             })
             : this.siteLambdaFunction;
         lambdaFn.node.addDependency(this.siteLambdaFunction);
-        /* Explicit dependencies ensure the function and alias exist before the URL is created */
-        this.siteLambdaUrl = lambdaFn.addFunctionUrl({
-            authType: FunctionUrlAuthType.NONE,
-        });
+        /* Explicit dependencies ensure the function and alias exist before the URL is created.
+           Default to AWS_IAM so the URL is reachable only via the CloudFront distribution
+           (signed through Origin Access Control) and not as a public endpoint. */
+        const authType = this.props.siteLambdaUrlAuthType ?? FunctionUrlAuthType.AWS_IAM;
+        this.siteLambdaUrl = lambdaFn.addFunctionUrl({ authType });
         this.siteLambdaUrl.node.addDependency(this.siteLambdaFunction);
         this.siteLambdaUrl.node.addDependency(lambdaFn);
-        /* Grant public invoke access — the resource-based policy is applied via
-           grantInvokeUrl, restricted by the FunctionUrlAuthType condition */
-        const principal = new AnyPrincipal();
-        principal.addToPolicy(new PolicyStatement({
-            actions: ['lambda:InvokeFunctionUrl'],
-            conditions: { StringEquals: { 'lambda:FunctionUrlAuthType': FunctionUrlAuthType.NONE } },
-            effect: Effect.ALLOW,
-            resources: ['*'],
-        }));
-        lambdaFn.grantInvokeUrl({ grantPrincipal: principal });
+        /* When the consumer explicitly opts into a public URL (authType=NONE), preserve the
+           previous behaviour and grant invoke access to the configured grantees
+           (defaulting to AnyPrincipal). When AWS_IAM is in effect, the resource policy is
+           added automatically by FunctionUrlOrigin.withOriginAccessControl, scoped to the
+           distribution ARN. */
+        if (authType === FunctionUrlAuthType.NONE) {
+            const grantees = this.props.siteLambdaUrlInvokeGrantees ?? [new AnyPrincipal()];
+            for (const grantee of grantees) {
+                if (grantee instanceof AnyPrincipal) {
+                    grantee.addToPolicy(new PolicyStatement({
+                        actions: ['lambda:InvokeFunctionUrl'],
+                        conditions: { StringEquals: { 'lambda:FunctionUrlAuthType': FunctionUrlAuthType.NONE } },
+                        effect: Effect.ALLOW,
+                        resources: ['*'],
+                    }));
+                }
+                lambdaFn.grantInvokeUrl({ grantPrincipal: grantee });
+            }
+        }
         this.addCfnOutput(`${this.id}-url`, this.siteLambdaUrl.url);
     }
     /**

package/dist/src/construct/site-with-lambda-backend/types.d.ts

@@ -1,4 +1,6 @@
 import { CachePolicyProps, OriginRequestPolicyProps, ResponseHeadersPolicyProps, ResponseHeadersStrictTransportSecurity, ResponseSecurityHeadersBehavior } from 'aws-cdk-lib/aws-cloudfront';
+import { IPrincipal, PolicyStatement } from 'aws-cdk-lib/aws-iam';
+import { FunctionUrlAuthType } from 'aws-cdk-lib/aws-lambda';
 import { CommonStackProps } from '../../common/index.js';
 import { AcmProps, CloudfrontFunctionProps, DistributionProps, LambdaProps, LogProps, S3BucketProps } from '../../services/index.js';
 import { SiteWithLambdaBackendResponseHeaderPolicyType } from './constants.js';
@@ -27,6 +29,26 @@ export interface SiteWithLambdaBackendProps extends CommonStackProps {
     siteHealthEndpoint: string;
     /** Configuration for the site Lambda function */
     siteLambda: LambdaProps;
+    /**
+     * Additional IAM policy statements to attach to the site Lambda execution role.
+     * Defaults to none — the role only has the CloudWatch Logs permissions granted by
+     * `AWSLambdaBasicExecutionRole`. Use this to grant the Lambda access to specific
+     * resources (e.g. invoking a sibling Function URL scoped to its ARN).
+     */
+    siteLambdaAdditionalPolicyStatements?: PolicyStatement[];
+    /**
+     * Auth type for the site Lambda Function URL.
+     * Defaults to `FunctionUrlAuthType.AWS_IAM` so the URL is reachable only via the
+     * CloudFront distribution signed through Origin Access Control. Set to
+     * `FunctionUrlAuthType.NONE` to publish a public unauthenticated URL.
+     */
+    siteLambdaUrlAuthType?: FunctionUrlAuthType;
+    /**
+     * Principals permitted to invoke the Function URL when `siteLambdaUrlAuthType` is
+     * `FunctionUrlAuthType.NONE`. Defaults to `[new AnyPrincipal()]` for backwards
+     * compatibility. Ignored when the auth type is `AWS_IAM`.
+     */
+    siteLambdaUrlInvokeGrantees?: IPrincipal[];
     /** Configuration for the site log group */
     siteLog: LogProps;
     /** Configuration for the S3 bucket used for access logs */

package/dist/src/services/cloudfront/main.d.ts

@@ -1,7 +1,6 @@
 import { ICertificate } from 'aws-cdk-lib/aws-certificatemanager';
 import * as cf from 'aws-cdk-lib/aws-cloudfront';
-import { DistributionAttributes, FunctionAssociation, IDistribution, IResponseHeadersPolicyRef, OriginAccessIdentity } from 'aws-cdk-lib/aws-cloudfront';
-import { HttpOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
+import { DistributionAttributes, FunctionAssociation, IDistribution, IOrigin, IResponseHeadersPolicyRef, OriginAccessIdentity } from 'aws-cdk-lib/aws-cloudfront';
 import { ISecurityGroup, IVpc } from 'aws-cdk-lib/aws-ec2';
 import { IAccessPoint } from 'aws-cdk-lib/aws-efs';
 import { Role } from 'aws-cdk-lib/aws-iam';
@@ -67,7 +66,7 @@ export declare class CloudFrontManager {
      * @param defaultFunctionAssociations optional CloudFront function associations for the default behavior
      * @param responseHeadersPolicy optional response headers policy for the default behavior
      */
-    createDistributionWithHttpOrigin(id: string, scope: CommonConstruct, props: DistributionProps, origin: HttpOrigin, domainNames: string[], logBucket?: IBucket, certificate?: ICertificate, defaultFunctionAssociations?: FunctionAssociation[], responseHeadersPolicy?: IResponseHeadersPolicyRef): cf.Distribution;
+    createDistributionWithHttpOrigin(id: string, scope: CommonConstruct, props: DistributionProps, origin: IOrigin, domainNames: string[], logBucket?: IBucket, certificate?: ICertificate, defaultFunctionAssociations?: FunctionAssociation[], responseHeadersPolicy?: IResponseHeadersPolicyRef): cf.Distribution;
     /**
      * @summary Method to provision a Lambda@Edge function
      * @param id scoped id of the resource

package/dist/src/services/codebuild/main.js

@@ -1,4 +1,4 @@
-import { Duration } from 'aws-cdk-lib';
+import { Duration, Stack } from 'aws-cdk-lib';
 import { BuildSpec, ComputeType, LinuxBuildImage, Project } from 'aws-cdk-lib/aws-codebuild';
 /**
  * Provides operations on AWS Code Build.
@@ -37,6 +37,11 @@ export class CodeBuildManager {
      */
     createProjectForCloudfrontInvalidation(id, scope, dockerFilepath, distributionId, paths) {
         const invalidationPaths = paths ?? '/*';
+        const stack = Stack.of(scope);
+        const distributionArn = `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${distributionId}`;
+        const logGroup = scope.logManager.createLogGroup(`${id}-project-log-group`, scope, {
+            logGroupName: `${id}-cloudfront-invalidation`,
+        });
         return new Project(scope, `${id}-install-deps-project`, {
             buildSpec: BuildSpec.fromObject({
                 phases: {
@@ -56,12 +61,10 @@ export class CodeBuildManager {
             logging: {
                 cloudWatch: {
                     enabled: true,
-                    logGroup: scope.logManager.createLogGroup(`${id}-project-log-group`, scope, {
-                        logGroupName: `${id}-cloudfront-invalidation`,
-                    }),
+                    logGroup,
                 },
             },
-            role: scope.iamManager.createRoleForCloudfrontInvalidation(id, scope),
+            role: scope.iamManager.createRoleForCloudfrontInvalidation(id, scope, [distributionArn], [logGroup.logGroupArn]),
             timeout: Duration.minutes(5),
         });
     }

package/dist/src/services/identity-access-management/main.d.ts

@@ -28,47 +28,47 @@ export declare class IamManager {
      * @param scope scope in which this resource is defined
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForReadSecrets(scope: CommonConstruct, resourceArns?: string[]): PolicyStatement;
+    statementForReadSecrets(scope: CommonConstruct, resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to put events
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForPutEvents(resourceArns?: string[]): PolicyStatement;
+    statementForPutEvents(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to start step function execution
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForStartExecution(resourceArns?: string[]): PolicyStatement;
+    statementForStartExecution(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to poll queue
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForPollQueue(resourceArns?: string[]): PolicyStatement;
+    statementForPollQueue(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to invoke lambda function
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForInvokeLambda(resourceArns?: string[]): PolicyStatement;
+    statementForInvokeLambda(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to read app config
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForReadAnyAppConfig(resourceArns?: string[]): PolicyStatement;
+    statementForReadAnyAppConfig(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to access app config
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForAppConfigExecution(resourceArns?: string[]): PolicyStatement;
+    statementForAppConfigExecution(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to put xray telemetry
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForPutXrayTelemetry(resourceArns?: string[]): PolicyStatement;
+    statementForPutXrayTelemetry(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to decrypt kms
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForDecryptKms(resourceArns?: string[]): PolicyStatement;
+    statementForDecryptKms(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to list s3 buckets
      * @param scope scope in which this resource is defined
@@ -79,7 +79,7 @@ export declare class IamManager {
      * @summary Method to create iam statement to list all s3 buckets
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForListAllMyBuckets(resourceArns?: string[]): PolicyStatement;
+    statementForListAllMyBuckets(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to get s3 objects in buckets
      * @param scope scope in which this resource is defined
@@ -105,17 +105,17 @@ export declare class IamManager {
      * @summary Method to create iam statement to pass iam role
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForPassRole(resourceArns?: string[]): PolicyStatement;
+    statementForPassRole(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to invalidate cloudfront cache
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForCloudfrontInvalidation(resourceArns?: string[]): PolicyStatement;
+    statementForCloudfrontInvalidation(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to access efs
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForWriteEfs(resourceArns?: string[]): PolicyStatement;
+    statementForWriteEfs(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to assume iam role
      * @param scope scope in which this resource is defined
@@ -126,7 +126,7 @@ export declare class IamManager {
      * @summary Method to create iam statement to pass ecs role
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForEcsPassRole(resourceArns?: string[]): PolicyStatement;
+    statementForEcsPassRole(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to run ecs task
      * @param scope scope in which this resource is defined
@@ -144,7 +144,7 @@ export declare class IamManager {
      * @summary Method to create iam statement to create any log stream
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForCreateAnyLogStream(resourceArns?: string[]): PolicyStatement;
+    statementForCreateAnyLogStream(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to write log events
      * @param scope scope in which this resource is defined
@@ -155,27 +155,28 @@ export declare class IamManager {
      * @summary Method to create iam statement to write any log events
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForPutAnyLogEvent(resourceArns?: string[]): PolicyStatement;
+    statementForPutAnyLogEvent(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to read items from dynamodb table
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForReadTableItems(resourceArns?: string[]): PolicyStatement;
+    statementForReadTableItems(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to write items from dynamodb table
      * @param resourceArns list of ARNs to allow access to
      */
-    statementForWriteTableItems(resourceArns?: string[]): PolicyStatement;
+    statementForWriteTableItems(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam statement to poll from dynamodb table
      * @param resourceArns list of ARNs to allow access to
      */
-    statementFordynamoDbStream(resourceArns?: string[]): PolicyStatement;
+    statementFordynamoDbStream(resourceArns: string[]): PolicyStatement;
     /**
      * @summary Method to create iam policy to invalidate cloudfront cache
-     * @param resourceArns list of ARNs to allow access to
+     * @param distributionArns CloudFront distribution ARNs to allow invalidation against
+     * @param logGroupArns CloudWatch log group ARNs the CodeBuild project writes to
      */
-    createPolicyForCloudfrontInvalidation(resourceArns?: string[]): PolicyDocument;
+    createPolicyForCloudfrontInvalidation(distributionArns: string[], logGroupArns: string[]): PolicyDocument;
     /**
      * @summary Method to create iam policy for SQS event processing
      * @param id scoped id of the resource
@@ -189,8 +190,10 @@ export declare class IamManager {
      * @summary Method to create iam role to invalidate cloudfront cache
      * @param id scoped id of the resource
      * @param scope scope in which this resource is defined
+     * @param distributionArns CloudFront distribution ARNs to allow invalidation against
+     * @param logGroupArns CloudWatch log group ARNs the CodeBuild project writes to
      */
-    createRoleForCloudfrontInvalidation(id: string, scope: CommonConstruct): Role;
+    createRoleForCloudfrontInvalidation(id: string, scope: CommonConstruct, distributionArns: string[], logGroupArns: string[]): Role;
     /**
      * @summary Method to create iam role for CloudTrail
      * @param id scoped id of the resource

package/dist/src/services/identity-access-management/main.js

@@ -28,9 +28,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['secretsmanager:GetSecretValue'],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? [
-                `arn:aws:secretsmanager:${Stack.of(scope).region}:${Stack.of(scope).account}:secret:*`,
-            ],
+            resources: resourceArns,
         });
     }
     /**
@@ -41,7 +39,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['events:PutEvents'],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
@@ -52,7 +50,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['states:StartExecution'],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
@@ -63,7 +61,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['sqs:ReceiveMessage', 'sqs:DeleteMessage', 'sqs:GetQueueAttributes'],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
@@ -74,7 +72,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['lambda:InvokeFunction'],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
@@ -98,7 +96,7 @@ export class IamManager {
                 'appconfig:ListDeployments',
             ],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
@@ -109,7 +107,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['appconfig:GetLatestConfiguration', 'appconfig:StartConfigurationSession'],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
@@ -120,7 +118,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['xray:PutTraceSegments', 'xray:PutTelemetryRecords'],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
@@ -131,7 +129,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['kms:Decrypt'],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
@@ -154,7 +152,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['s3:ListAllMyBuckets'],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
@@ -167,6 +165,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['s3:GetObject', 's3:GetObjectAcl'],
             effect: Effect.ALLOW,
+            /* defaults to the supplied bucket's objects - already scoped, not a wildcard */
             resources: resourceArns ?? [bucket.arnForObjects(`*`)],
         });
     }
@@ -180,6 +179,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['s3:DeleteObject'],
             effect: Effect.ALLOW,
+            /* defaults to the supplied bucket's objects - already scoped, not a wildcard */
             resources: resourceArns ?? [bucket.arnForObjects(`*`)],
         });
     }
@@ -193,6 +193,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['s3:PutObject', 's3:PutObjectAcl'],
             effect: Effect.ALLOW,
+            /* defaults to the supplied bucket's objects - already scoped, not a wildcard */
             resources: resourceArns ?? [bucket.arnForObjects(`*`)],
         });
     }
@@ -204,7 +205,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['iam:PassRole'],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
@@ -215,7 +216,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['cloudfront:GetInvalidation', 'cloudfront:CreateInvalidation'],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
@@ -226,7 +227,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['elasticfilesystem:*'],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
@@ -250,7 +251,7 @@ export class IamManager {
             actions: ['iam:PassRole'],
             conditions: { StringLike: { 'iam:PassedToService': 'ecs-tasks.amazonaws.com' } },
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
@@ -293,7 +294,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['logs:CreateLogStream'],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
@@ -321,7 +322,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['logs:PutLogEvents'],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
@@ -341,7 +342,7 @@ export class IamManager {
                 'dynamodb:BatchGetItem',
             ],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
@@ -352,7 +353,7 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['dynamodb:BatchWriteItem', 'dynamodb:DeleteItem', 'dynamodb:PutItem', 'dynamodb:UpdateItem'],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
@@ -363,19 +364,20 @@ export class IamManager {
         return new PolicyStatement({
             actions: ['dynamodb:DescribeStream', 'dynamodb:GetRecords', 'dynamodb:GetShardIterator', 'dynamodb:ListStreams'],
             effect: Effect.ALLOW,
-            resources: resourceArns ?? ['*'],
+            resources: resourceArns,
         });
     }
     /**
      * @summary Method to create iam policy to invalidate cloudfront cache
-     * @param resourceArns list of ARNs to allow access to
+     * @param distributionArns CloudFront distribution ARNs to allow invalidation against
+     * @param logGroupArns CloudWatch log group ARNs the CodeBuild project writes to
      */
-    createPolicyForCloudfrontInvalidation(resourceArns) {
+    createPolicyForCloudfrontInvalidation(distributionArns, logGroupArns) {
         return new PolicyDocument({
             statements: [
-                this.statementForCreateAnyLogStream(),
-                this.statementForPutAnyLogEvent(),
-                this.statementForCloudfrontInvalidation(),
+                this.statementForCreateAnyLogStream(logGroupArns),
+                this.statementForPutAnyLogEvent(logGroupArns),
+                this.statementForCloudfrontInvalidation(distributionArns),
                 new PolicyStatement({
                     actions: [
                         'ecr:GetDownloadUrlForLayer',
@@ -384,7 +386,9 @@ export class IamManager {
                         'ecr:GetAuthorizationToken',
                     ],
                     effect: Effect.ALLOW,
-                    resources: resourceArns ?? ['*'],
+                    /* ecr:GetAuthorizationToken does not support resource-level IAM and must
+                       use Resource:* per AWS docs; the other ECR actions inherit the same. */
+                    resources: ['*'],
                 }),
             ],
         });
@@ -418,12 +422,14 @@ export class IamManager {
      * @summary Method to create iam role to invalidate cloudfront cache
      * @param id scoped id of the resource
      * @param scope scope in which this resource is defined
+     * @param distributionArns CloudFront distribution ARNs to allow invalidation against
+     * @param logGroupArns CloudWatch log group ARNs the CodeBuild project writes to
      */
-    createRoleForCloudfrontInvalidation(id, scope) {
+    createRoleForCloudfrontInvalidation(id, scope, distributionArns, logGroupArns) {
         return new Role(scope, `${id}-install-deps-project-role`, {
             assumedBy: new ServicePrincipal('codebuild.amazonaws.com'),
             inlinePolicies: {
-                codeBuildPolicy: this.createPolicyForCloudfrontInvalidation(),
+                codeBuildPolicy: this.createPolicyForCloudfrontInvalidation(distributionArns, logGroupArns),
             },
             roleName: scope.resourceNameFormatter.format(`${id}-cf-invalidation`, scope.props.resourceNameOptions?.iam),
         });
@@ -463,7 +469,13 @@ export class IamManager {
      */
     createRoleForEcsEvent(id, scope, cluster, task) {
         const policy = new PolicyDocument({
-            statements: [this.statementForRunEcsTask(scope, cluster, task), this.statementForEcsPassRole()],
+            statements: [
+                this.statementForRunEcsTask(scope, cluster, task),
+                /* iam:PassRole condition (PassedToService=ecs-tasks) already limits which roles
+                   the EventBridge target can pass; resource scope kept wildcard to allow any
+                   ECS task role the consumer wires up */
+                this.statementForEcsPassRole(['*']),
+            ],
         });
         const role = new Role(scope, `${id}`, {
             assumedBy: new ServicePrincipal('events.amazonaws.com'),
@@ -506,7 +518,9 @@ export class IamManager {
         const role = new Role(scope, `${id}`, {
             assumedBy: servicePrincipal ?? new ServicePrincipal('lambda.amazonaws.com'),
             description: `Role for ${id} Lambda function`,
-            inlinePolicies: { policy },
+            /* skip the inline policy when empty - CDK rejects inlinePolicies entries
+               without statements */
+            inlinePolicies: policy.isEmpty ? undefined : { policy },
             managedPolicies: [
                 ManagedPolicy.fromManagedPolicyArn(scope, `${id}-AWSLambdaBasicExecutionRole`, 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'),
             ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gradientedge/cdk-utils-aws",
-  "version": "2.17.0",
+  "version": "2.18.0",
   "description": "AWS CDK utilities for @gradientedge/cdk-utils",
   "type": "module",
   "main": "dist/src/index.js",
@@ -24,7 +24,7 @@
     "lodash": "4.18.1",
     "moment": "2.30.1",
     "uuid": "14.0.0",
-    "@gradientedge/cdk-utils-common": "2.10.0"
+    "@gradientedge/cdk-utils-common": "2.11.0"
   },
   "keywords": [
     "gradientedge",